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Introduction 


This document describes procedures for using Wind River Workbench with the 
Wind River Probe and Wind River ICE emulators to bring up a target board, from 
the first power-up through running and debugging application code. 


This document includes the following chapters: 

1. Introduction -- Introduces the document. 

2. On-Chip Debugging -- Describes of the theory of on-chip debugging. 
3. Board Bring-Up -- Provides an overview of board bring-up procedure. 


4. Board Descriptor Files -- Describes how to create, edit, and use board descriptor 
files. 


5. OCD Connections -- Describes making an OCD connection to a target using a 
JTAG or BDM port. 


6. Tool Configuration -- Describes hardware-specific configuration options for Wind 
River emulators. 


7. Board Initialization -- Describes how to use Wind River emulators to initialize the 
target hardware. 


8. Verifying Hardware -- Describes how to use Wind River Workbench to run 
hardware diagnostics on your target. 


9. Testing Memory -- Describes how to use Wind River emulators to suspend CPU 
operations and force the target into background mode. 


10. Debugging in RAM -- Describes how to create a project, download code and 
symbol information, set software breakpoints, and step through code. 
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11. Programming Flash Memory -- Describes working with flash memory on your 
target. 


12. Debugging in ROM -- Describes using hardware breakpoints to debug in ROM. 


A. Pins Mapped to Common Signals -- Provides a mapping reference for Wind 
River-supported processor families. 


B. Internal Breakpoint Capabilities -- Provides a detailed reference for line, 
expression, and hardware breakpoints in Workbench. 


C. Pin Terminations -- provides a detailed reference of pinouts for Wind 
River-supported processor families. 


On-Chip Debugging 


Almost all embedded systems have hardware and software elements, which are 
separate but interdependent. Since embedded systems generally do not have 
keyboards, or any kind of user interface, debugging of their software elements 
must be done externally. 


An older solution to this problem was the in-circuit emulator, which substituted its 
own internal processor for the central processing unit (CPU) of the embedded 
system. 


However, in-circuit emulators are expensive; and since they are made by 
third-party vendors, there is often a long delay between a new target and a new 
in-circuit emulator that can attach to it. A cheaper, and more easily implemented, 
solution is on-chip debugging (OCD). 


Many semiconductor manufacturers now integrate dedicated debug 
microcircuitry into their chips. This approach adds hardware and software debug 
capability to the existing JTAG or BDM ports. Since the debug operations occur on 
a dedicated area of the chip itself, this solution is known as on-chip debugging. 


OCD combines many features of software debug monitors and in-circuit 
emulators. Like an in-circuit emulator, OCD provides low-level hardware access. 
It does not need to use target memory; it does not need a target communication 
channel; and it can edit memory and registers without halting the processor. Like 
a software monitor, OCD lets you set breakpoints, stop and start the CPU, step 
through code, examine memory, and run diagnostic tests; but unlike a software 
monitor, OCD does not need good hardware to run. 


Software defects that cause the operating system to crash will typically cause an 
agent-based debug environment to fail. However, since an OCD connection is 
implemented in the hardware, it is not as sensitive. 


Table 2-1 
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An OCD connection remains active even on bad hardware. Using an OCD 
connection, you can download low-level software even when the target board is 
not functioning correctly, and the boot loader cannot run. 


On-chip debugging capability varies from one processor family to another, but the 
provided functionality is generally similar. As an illustration, Freescale ColdFire 
processors use the following primitives for Background Debug Mode (BDM): 


Freescale ColdFire OCD Primitives 


Command Mnemonic Description 

Read Register RDREG Read a data register and return the value. 
Write Register WDREG Write a value to a data register. 

Read Memory READ Read from a memory location. 

Write Memory WRITE Write to a memory location. 

Stop Processor BGND Assume control of the bus and put processor in 


background mode. 
Single Step STEP Step one instruction. 


Resume GO Resume execution at the program counter's 
current location. 


Wind River tools use these low-level OCD primitives as building blocks to create 
a higher level of primitives, thus allowing hardware and software verification. 


OCD commands invoked while the processor is running “steal” bus cycles from 
the CPU in the same way a Direct Memory Access (DMA) controller does. 


As the debugger reads and writes to memory and registers, it halts the CPU and 
restarts it. The CPU is not involved in OCD operations. The BGND instruction from 
the OCD hardware will cause the CPU to halt, and the OCD hardware will assume 
control of chip operations. A GO (Resume) command will flush OCD operations 
and restart the CPU. 


The Wind River Probe and Wind River ICE SX tools use the on-chip debug 
capabilities embedded in the target processor. These tools are not true in-circuit 
emulators, because they do not replace the target CPU with their own internal 
processor. However, the functions they perform are similar, and this document will 
refer to them as “emulators”. 


2 On-Chip Debugging 


OCD has many advantages over in-circuit emulation. It is cheaper; the debug 
hardware is included by the silicon manufacturer, not by a third party; and unlike 
an in-circuit emulator, the OCD hardware does not lag behind chip releases. 


When you access the OCD services on the chip, all interaction between the 
Wind River Probe or Wind River ICE SX and the target runs exclusively through 
the OCD connection. This means that your system is effective for the entire 
development process, even before board-level peripherals are stable. 


ColdFire processors, and some older PowerPC processors (5xx and 8xx) use a 
dedicated BDM port for OCD operations. A more recent approach is to attach the 
OCD functions to the Joint Test Action Group (JTAG) interface to communicate to 
the target CPU, and share this interface with boundary-scan board-circuit testing. 
The JTAG interface follows the IEEE 1149.1 boundary-scan (JTAG/Test Interface) 
specification. 


The JTAG interface consists of a set of five signals, three JTAG registers, and a test 
access port (TAP) controller. The TAP controller is typically embedded in the target 
microprocessor or device. The information related signals are TDI (Test Data In) 
and TDO (Test Data Out). The boundary-scan register chain (data) includes 
registers controlling the direction of the input/output drivers, as well as registers 
reflecting the signal value received or driven. The expectation and details of 
particular CPU chains are encoded directly into the emulator firmware. 


Each device sharing the JTAG interface employs a serial stream of relative data. 
The data streams for all devices can be chained together. An associated process can 
scan the combined chain to extract any particular device’s information. 


For further information about JTAG operations, refer to the IEEE 1149.1 
specification at http://standards.ieee.org. 


Wind River emulators are non-intrusive; that is, they do not use target resources. 
An emulator will not affect target memory, stack space, or the flash workspace. 


On-chip debug agents reside inside cache and memory management units they 
share the chip with, so the OCD hardware sees address and data values just like 
the CPU sees them. Some processor families have dedicated output signals (other 
than the JTAG pins) that can deliver information on the state of the processor. 
Combined with external hardware (such as the Wind River ICE SX, in conjunction 
with the Wind River Trace tool) these signals can log the real-time code execution 
history to a trace buffer. This data is helpful when you need to debug problems that 
only occur when the processor is running at full speed. 


There is an industry standard, not yet widely adopted, created by the Global 
Embedded Processor Debug Interface Forum, formally called IEEE-ISTO 5001. For 
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the standard, and a good deal of further information, see 
http://www.nexus5001.org/standard.html. 


Board Bring-Up 


3.1 Goals and Objectives 7 


3.2 Sequence of Events 7 


3.1 Goals and Objectives 


The goal of a board bring-up procedure is to verify the operation of a target board, 
all the way from power-on to successfully running and debugging code. 


This chapter provides a general overview of board bring-up procedure. Later 
chapters go over the matter in detail. 


3.2 Sequence of Events 


In general, the procedure of bringing up a board uses the following general outline: 


» Attempt a “smoke test”-- that is, can you apply power to the board without 
damaging it? 


"Perform a “lamp check” -- turn the LEDs on and off 
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« Establish a JTAG or BDM connection to the emulator. 

« Configure the emulator-target interface; set voltage, clock rate, signal logic. 
« Enter background mode. 

« Read and write core registers. 

« Configure the target workspace. 

« Run simple RAM tests. 

« Run bus tests on the address and data buses. 

« Test low-level stepping and breakpoints. 

« Execute low-level code. 

« — Test source-level stepping and breakpoints. 

« Execute application. 

« Debug application code in RAM. 

« Test the target’s ability to erase and program flash memory. 


« Debug application code in ROM. 


4.1 
4.2 
4.3 
Aa 
4.5 
4.6 


Board Descriptor Files 
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XML Board Files 20 

Manually Creating XML Board Files 23 
Layout, Routing and Design Considerations 25 


JTAG Timing Parameters for Wind River Emulators 26 


4.1 Introduction 


In most cases you do not need to concern yourself with the JTAG board file. 
However, if you are debugging multiple cores or if your JTAG scan chain has other 
devices besides the core on it, your emulator requires a board descriptor file to 


correctly set up the JTAG scan chain for your target. 


The board file provides a description of each of the devices that are included in the 


scan chain, and provides information about each device. 


All Wind River target boards are shipped with a board descriptor file that works 
for that target board. If you are using a Wind River target board, you can specify 
the default board descriptor file for that target in the New Connection Wizard in 
Wind River Workbench, as described in the Establishing Communications chapter of 


your emulator’s Hardware Reference. 
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NOTE: If you choose to modify a board descriptor file that was shipped with 
Wind River Workbench, save your modified file with a different name to prevent 
overwriting the default file. 


Board descriptor files are written in extensible markup language (XML). However, 
it is easiest to create or modify board files using Workbench. The software allows 
you to create and catalog scan chain devices such as processors, complex 
programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), 
and application-specific integrated circuits (ASICs), and from that catalog create a 
board file that properly describes the scan chain on your target. 


A CAUTION: Your board file must list the devices included on your scan chain in the 
same order as they are physically laid out on the target. If the board file and the 
physical scan chain do not match, the board file for your target will not work. 


4.2 Creating a New Board Descriptor File 


Workbench uses JTAG Editor to create and modify board files. To use the JTAG 
Editor view, you must first have an active project running. For information on 
creating projects, see the Wind River Workbench User’s Guide. 


To create a new board file: 
1. Open your project in Workbench. 
2. Select File > New > JTAG Board Layout. 
The Create Board File dialog appears, as shown in Figure 4-1. 


4 Board Descriptor Files 
4.2 Creating a New Board Descriptor File 


Figure 4-1 Create Board File Dialog 


Create Board File 
The folder is empty. 


Enter or select the parent folder: 


H (3 Test_OCD_Project (Wind River Standalone (No Operating System) Pla 


< > 


File name: debug! layout 


Advanced >> 


Wind River Workbench automatically populates the Parent Folder field with 
your active project. In the File Name field, type aname for your board file. This 
creates a .layout file, which JTAG Editor will use to create a .brd file in the next 
step. 


The example shown in Figure 4-1 creates a file called debug1.layout for the 
project debug]. 


3. Click Finish. 
This opens the JTAG Editor view, as shown in Figure 4-2. 


NOTE: JTAG Editor edits a .layout file, which is a graphic representation of the 


board layout. A .brd file cannot be created until you have created a JTAG 
layout, such as the one shown in Figure 4-4. 
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Figure 4-2. JTAG Editor 


EMPC8260: ES debugi.layout 23 oO 
| I> Select 


i. Marquee 


~~ Connection 

= Scan Chain * 
Single Core 

Dual Core 

3 Core 

4 Core 

™, Custom a 


@ 11 
@) TD 
Ce] ceu 


EE] asic/rrca 
i Peripheral 


Using the Predefined Layouts in JTAG Editor 


JTAG Editor includes predefined graphic layouts for one, two, three, and four 
cores, which are displayed in the Editor toolbar to the left of the editing field, 
as shown in Figure 4-3. 
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Figure 4-3. JTAG Editor Toolbar 


[> Select 


ii, Marquee 


~~ Connection 

= Scan Chain al 
Single Core 

Dual Core 

3 Core 

4 Core 

=, Custom * 


@) TDI 
(@) TDO 
f-] cpu 


[2] asic/rpca 
= Peripheral 


In the rare case where you need to debug more than four cores at the same 
time, the JTAG Editor also includes a Custom option. See Using the Custom 
Option in the JTAG Editor View, p.17, for more information. 


4. Inthe JTAG toolbar, click Select. 
5. Under Scan Chain, pick the number of cores you need to debug. 
For example, if the debug! project has two cores, click on Dual Core under the 


Scan Chain heading and drag it into the editing field, as shown in Figure 4-4. 


NOTE: The core icon must be clicked and dragged into the editing field. Just 
clicking on it will not do anything. 


13 


Wind River 
Board Bring-Up Guide, 1.0 


Figure 4-4 Dual Core Layout 


AEMPCB260: ~ *debugl layout 
[> Select 


fl, Marquee 


1 1 


+ Connection ee ee 


cpu cpu 
Scan Chain Undefined Undefined 


= Custom 


= Peripheral 


NOTE: You can only drag one predefined layout into the editing field at a time. 
If you drag ina second layout, it will overlay the first, causing confusion. 


The editing field now shows a graphic representation of the scan chain. Notice 
that the two cores are labelled Undefined. They have no properties until you 
assign them in the next step. 


6. Double-click on the first core. 


The Device Setup dialog appears, as shown in Figure 4-5. 
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Figure 4-5 


Device Setup 


Device Setup 


4 Board Descriptor Files 
4.2 Creating a New Board Descriptor File 


PowerPC 


MPC44x MmPC740 
MPC4xx MPC?7S0 
MPCSxxx PPC?SOCX 
ie} MPCéxx PPC7SOCXI 
PP FX 
MPC74xx PPC7SOGX 
RESIS MPC755 
MPC82xx 
MPC85Sxx 
MIPS 


Motorola Power PC 740 Processor DES_?Xx_00 
Motorola Power PC 750 Processor DES_?*x_01 
IBM Power PC 750CX Processor DES_?7x%x_02 
DES_7XX_03 


DES_7xX_05 
Motorola Power PC 755 Processor DES_?Xx_06 


Use the dialog to select your processor type. The example in Figure 4-5 shows 


a PPC750EFX processor. 


7. Click OK. 


cont_| 


You are returned to the Device Debug Perspective. The first core is now 
defined as a PPC750FX, and the Properties view is displayed. 
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Figure 4-6 


Figure 4-7 
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Defining the Core 


i Embedded Debug - JTAG Board Editor - Wind River Workbench 2.2 


PPC7SOFX - WRPrabe_PPC7SOFX [Attach to Core(s) on Te 
5 PPC7SOFX: 


You can use the Properties view to finish defining the first core. 


Properties View 


Ss oS 


& 


IBM Power PC 7S50FX Processor 
_DES_7xX*_O4F 


IR Length 3 

Memory Map DEFAULT 

Name PPC?YSOFX 

Register File 

Target PPC?YSOFX 

Type MICROPROCESSOR 
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4 Board Descriptor Files 
4.2 Creating a New Board Descriptor File 


Click on any property to modify it. 


Clicking on the Register File property will open a browser window; use the 
browser to navigate to the .reg file you want to use. 


Your first core is now defined. To define your second core, double-click on it and 
repeat Steps 6 through 8. 


If both cores use the same processor type, make sure you edit the Designator value 
in the Properties view. Workbench does not allow two cores to have the same 
unique designator. For example, in Figure 4-7 the first core’s designator is 
DES_7XX_04. If your second core is the same processor type as the first, the same 
designator will appear in the Properties window. Click on the Designator value to 
change it to (for instance) DES_7XX_05. 


Once you have defined all your cores, you can create your board file. 


9. 


10. 


11. 


Right-click on the editing area. In the dialog that appears, choose Export Board 
File. 


A browser window appears. Choose the folder you want to save your board 
file in. 


In the File Name field, type the name you wish to assign to your board file. 
In the example, the board file name is debug1.brd. 
Click Save. 


Using the Custom Option in the JTAG Editor View 


In the rare case where you need to debug more than four cores at the same time, 
JTAG Editor uses a Custom option to create a new board file piece by piece. 


1. 
2 


In the JTAG toolbar (Figure 4-3), click Custom. 
Construct your layout using the elements under the Custom heading. 


The elements available are an input node (TDI) and a termination node (TDO), 
as well as CPUs, ASICs, FPGAs, and peripherals. To add an element, click on 
its icon and drag it into the editing field. 


Figure 4-8 shows a partially completed layout with an input, a terminator, 
three CPUs, and a peripheral device. 


Figure 4-8 
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Partial Custom Layout 
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Once you have your terminating nodes and devices laid out, you need to 
connect them. 


In the JTAG toolbar, click Connections. 


When you move the cursor back into the editing field, it now looks like a 
power cord. 


Click on the input node. 
Move the cursor to your first processor and click again. 
A connection line joins the input node and the processor. 


Click on the first processor, move the cursor to the second processor, and click 
on it. 


A connection line joins the two processors. 


Continue this process until you complete the circuit by clicking on the 
terminator node. 


4 Board Descriptor Files 
4.2 Creating a New Board Descriptor File 


Figure 4-9 Completed Custom Layout 


Aa 
it 


| cpu Se 
Undefined ty 
[cpu | 
— Undefined 
1 
cpu 


Undefined 


OTHER 
Undefined 


8. When you have connected all devices and nodes, click Connections again. The 


cursor returns to normal. 


Your custom board is now laid out. Define its properties and generate your .brd 
file by following Steps 6-11 in Using the Predefined Layouts in JTAG Editor, p.12. 


Editing Your Board Layout 


To remove a device, node, or connection from your layout, use the Select button or 


the Marquee button in the JTAG toolbar. 


To use the Select button, click Select in the toolbar. Then click on any device, node, 


or connection to highlight it and press Delete. 


To use the Marquee button, click Marquee in the toolbar. You will see that the 
cursor now appears as a crosshair in the editing field. Hold the mouse button 
down and drag the cursor to create a box around the device you wish to highlight, 


then press Delete. 
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NOTE: The Marquee button can only highlight devices, not nodes or connections. 


You can also edit your layout using the Outline view in Workbench. In the 
Workbench toolbar, click on Window. Select Show View > Outline. 


The Outline view appears as shown in Figure 4-10. 


Figure 4-10 Outline View 


B= Outline £3 \_FlashP... | 76 7. 
be 
Ci Undefined 
TDI 
Undefined 
Undefined 
Undefined 
@ ToDo 


The Outline view displays the elements of your layout in the order they were 
added. Click on any element to highlight it and press Delete. 


Using the Outline view in this way is handy if you have accidentally overlaid one 
layout on top of another, or if you want to back up and start again. Use the list in 
the Outline window to delete any or all of the contents of the JTAG editing field. 


4.3 XML Board Files 


Board descriptor files are created in extensible markup language (XML). You can 
view the XML version of your board file by opening your .brd file in a text editor, 
or by selecting File > Open in Workbench and navigating to the .brd file in the 
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Figure 4-11 


4 Board Descriptor Files 
4.3 XML Board Files 


browser window that appears. The XML text will appear in the Workbench Editor. 
An example board descriptor file is shown below. 


Board File XML version 


(Aeepcrsorx: | @*T1aGBoardedtor fT eee ee 5) 


<DEVICE_ TABLE> * 
<TABLE _MODE>SLOW</TABLE_MODE> 
<TABLE_CLOCK>16Mhz</ TABLE _CLOCK> 
<TABLE_MULTI>ENABLE</TABLE_MULTI> 
<TABLE_TIED_RESET>OFF</TABLE_TIED_RESET> 
<DEVICE> 
<NAME>PPC7SOFX</NAME> 
<DESCRIPTION>IBM Power PC 750FX Processor</DESCRIPTION> 
<TYPE>MICROPROCESSOR</ TYPE> 
<TARGET>PPC7S50FX</ TARGET> 
<SELREG_FILE></SELREG_FILE> 
<DESIGNATOR>DES_7XX_04</DESIGNATOR> 
<IR_LEN>8</ IR_LEN> 
<ASF_FILE></ ASF_FILE> 
<REG_FILES> 
</REG_FILES> 
<MEMORY_MAP> 
<MEMORY_MODE>DEF AULT</ MEMORY_MODE> 

</MEMORY_MAP> 

</DEVICE> 

<DEVICE> 
<NAME>PPC7S5S0F X</NAME> 
<DESCRIPTION>IBM Power PC 750FX Processor</DESCRIPTION> 
<TYPE>MICROPROCESSOR</ TYPE> 
<TARGET>PPC750FX</ TARGET> 
<SELREG_FILE></SELREG_FILE> 
<DESIGNATOR>DES_7XX_05</ DESIGNATOR> 
<IR_LEN>8</ IR_LEN> 
<ASF_FILE></ASF_FILE> 
<REG_FILES> 
</REG_FILES> 
<MEMORY_MAP> 

<MEMORY_MODE>DEF AULT</ MEMORY_MODE> 

</MEMORY_MAP> 

</DEVICE> 

</DEVICE_TABLE> 


This is the debug1.brd board file created in Using the Predefined Layouts in JTIAG 
Editor, p.12. The first block of code contains comments that describe what the target 


reference design is set for; the next blocks of code define the devices included in 
the file. 


For information on board file fields, see 4.3.1 XML Board File Fields, p.22. 


NOTE: If you choose to modify a board descriptor file shipped with your system, 
it is best to save your modified file with a different name to prevent overwriting 
the default file. 
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4.3.1 XML Board File Fields 


The board descriptor file contains comments, <DEVICE_TABLE >fields, and one 
or more <DEVICE> field-sets. A <DEVICE_TABLE> specifies common and 
rudimentary scan-chain (signal) operational functions and provides a list of 
<DEVICE> descriptions for each device sharing the JTAG interface. 


<DEVICE_TABLE> Fields 


<TABLE_MODE> 


This field designates the scan-chain characteristics applicable to the devices on the 
chain. It can be set to FAST or SLOW. This also relates to the optimization 
implementation on the emulator. When in doubt, set it to SLOW. 


<TABLE_CLOCK> 


This field specifies the JTAG strobe rate, in MHz, for the information signals Test 
Data In (TDI) and Test Data Out (TDO). This is analogous to the emulator 
configuration option CF CLK clock_rate. They are not always automatically 
synchronized, so check your emulator to make sure you have the CF CLK option 
set to the same clock rate specified in the board file. The fastest JTAG clock rate is 
16 MHz. 


<TABLE_MULTI> 


Set this field to ENABLE if you are debugging multiple targets on the same JTAG 
interface. Otherwise set it to DISABLE. 


<TABLE_TIED_RESET> 
Set this field to ON only if your target board’s RESET and TRST signals on the JTAG 


interface are physically connected (tied together.) 


<DEVICE> Fields 


<NAME> 


A reference name for the target device. 


<DESCRIPTION> 


A reference description of the target device. 
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<TYPE> 


The valid types are MICROPROCESSOR, CPLD, FPGA, INTERFACE, and 
OTHER. 


<TARGET> 


The CPU type. The run-time processes on Wind River emulators require this 
information in order to match the exact JTAG scan chain and JTAG-specific 
characteristics. 


<DESIGNATOR> 


A mandatory field that Workbench uses to distinguish between devices. Typically 
this is set to UO, U1, U2... 


Make sure you use a unique <DESIGNATOR> tag for each target device. 
Workbench does not allow two devices to use the same designator. 
<IR_LENGTH> 


Use this field to specify the length, in bits, of the target device’s JTAG Instruction 
Register. To find this information, consult the manufacturer’s specification for the 
target device. 


4.4 Manually Creating XML Board Files 


If you need a custom board file, it is usually easiest to take one of the generic board 
files from installDir/workbench-version/dfw/build/host/boardfiles and modify it to 
suit your needs. Remember to save it with a different name if you want to preserve the 
original file. 


To create a board file that properly describes the scan chain on your target: 
1. Open a text editor. 

2. Begin the board file with the tag <DEVICE_TABLE>. 

3. Lay out the header block. 


The first block of XML defines mode, clock speed, and status of multi-core 
debugging. An example would look like: 
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<TABLE_MODE>SLOW</TABLE_MODE> 
<TABLE_CLOCK>16Mhz</TABLE_CLOCK> 
<TABLE_MULTI>ENABLE</TABLE_MULTI> 
<TABLE_TIED_RESET>ON</TABLE_TIED_RESET> 


This example is set for slow mode, with a clock speed of 16 MHz; it is enabled 
for multi-core debugging, and it is set to issue RST reset commands (which 
affect all cores) rather than IN reset commands (which affect only one core.) 


The next blocks of XML define the devices included in the file. Workbench needs 
this information so that it can position the devices in the correct location in the 
25-bit data stream. The physical location of each device can also be determined by 
its position in the board descriptor file. 


4. 
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Lay out the block for the first device. 

A device block begins with the tag <DEVICE>. An example would look like: 

<DEVICE> 
<NAME>MPC8260</NAME> 
<DESCRIPTION>Motorola Power PC 8260 Processor</DESCRIPTION> 
<TYPE>MICROPROCESSOR</TYPE> 
<TARGET>MPC8260</TARGET> 
<DESIGNATOR>U0</DESIGNATOR> 
<IR_LEN>8</IR_LEN> 

</DEVICE> 

This example describes a PowerPC 8260 target. 

Repeat Step 4 for every device on the JTAG scan chain. 


Your board file must list the devices included on your scan chain in the same 
order as they are physically laid out on the target. If the board file and the 
physical scan chain do not match, the board file for your target will not work. 


When you are finished, your board file should look something like this: 
<DEVICE_TABLE> 
<TABLE_MODE>SLOW</TABLE_MODE> 
<TABLE_CLOCK>16Mhz</TABLE_CLOCK> 


4 Board Descriptor Files 
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<TABLE_MULTI>ENABLE</TABLE_MULTI> 

<TABLE_TIED_RESET>OFF</TABLE_TIED_RESET> 

<DEVICE> 
<NAME>MPC8260</NAME> 
<DESCRIPTION>Motorola Power PC 8260 Processor< /DESCRIPTION> 
<TYPE>MICROPROCESSOR</TYPE> 
<TARGET>MPC8260</TARGET> 
<DESIGNATOR>U0</DESIGNATOR> 
<IR_LEN>8</IR_LEN> 

</DEVICE> 

<DEVICE> 
<NAME>PPC750FX</NAME> 
<DESCRIPTION>IBM Power PC 750FX Processor</DESCRIPTION> 
<TYPE>MICROPROCESSOR</TYPE> 
<TARGET>PPC750FX</TARGET> 
<DESIGNATOR>U1</DESIGNATOR> 
<IR_LEN>8</IR_LEN> 

</DEVICE> 

</DEVICE_TABLE> 


This example describes two targets, but you can add as many <DEVICE> 
blocks as you need to describe your JTAG scan chain. 


6. When you are finished, save the file with the extension .brd. 


4.5 Layout, Routing and Design Considerations 


Wind River recommends the following routing requirements to minimize the 
possibility of JTAG communication failures. 
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Position the first device in the JTAG scan chain between one half and two 
thirds of the total routing length of the chain. This will minimize the reflections 
back to the first device in the scan chain. 


Route the TCK and TMS signals to approximately the same length from device 
to device. 


Provide a series dampening resistor as close as possible to the JTAG header for 
the TCK, TMS and TDI signals. A series resistor should also be positioned on 
the TDO output from device to device, and positioned as close as possible to 
the source. The last device in the JTAG scan chain should minimize reflections. 
These resistor values can be adjusted to match the impedance of the circuit 
board trace. 


Position the last device in the scan chain as close as possible to the JTAG 
connector to minimize the trace length of the TDO signal back to the emulator. 


Provide the ability to bypass any and all devices except the processor in the 
scan chain with zero-ohm resistors or jumpers. 


4.6 JTAG Timing Parameters for Wind River Emulators 


Table 4-1 


The 
and 


following table describes JIAG timing parameters for the Wind River probe 
Wind River ICE. 


JTAG Timing Parameters 


TCK TDO TDO TMS TMS TDI TDI 
Min Prop MaxProp MinProp MaxProp Min Min Hold 
Delay Delay Delay Delay Setup 

Negative Edge -3ns +3 ns -3 ns +3 ns 

Positive Edge 23 ns 3 ns 
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5.1 Debug Connections 


To create a target connection, create projects, and download code, you need a 
Wind River Probe or a Wind River ICE SX. 


For software-only tests, you can create a simulated connection using the Wind 
River Instruction Set Simulator (ISS), which is available to all users of Wind River 
Workbench OCD Edition. For instructions on using the Instruction Set Simulator, 
see the Wind River Workbench On-Chip Debugging Guide. 


The instructions in this document use a Wind River Probe connecting to a 
PowerPC750FX target. The process for connecting with the ICE is similar; for 
instructions on connecting with a Wind River ICE SX, see the Wind River ICE SX for 
Wind River Workbench Hardware Reference. 
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5.2 Creating a Target Connection 


To create a target connection using a Wind River Probe, use the following steps: 
1. Open Wind River Workbench. 
2. Right-click in the Target Manager view and select New Connection. 


The Connection Type dialog appears, as shown in Figure 5-1. 


Figure 5-1 Choose Connection Type 


WW New Connection 


Connection Type 


Please select connection type. 


Wind River Generic GDB Remote Serial Protocol Connection 
Wind River Linux KGDB Connection 

Wind River Linux User Mode Target Server Connection 
Wind River OCD ICE Connection 

Wind River OCD ISS Connection 


es |e | | = 


3. Select Wind River OCD Probe Connection and click Next. 


The Processor Selection dialog appears, as shown in Figure 5-2. 
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Figure 5-2 


5 OCD Connections 
5.2 Creating a Target Connection 


Processor Selection 


~“) New Connection 


Wind River Probe Settings 


Configure the designator settings For the emulator. 


Designators 


©Processor: | pPC7S0FX | 


© Board file: 


Designator Processor Processor Plugin 
PPC750FX PPC750FX PowerPC 7xx Family Processor Pl... 


Communications 


USB Device Name: |/PRO40310 


| 


4. Click Select. From the list that appears, expand MPC7xx and select MPC750FX. 


5. 


Click OK. 


You are returned to the Processor Selection dialog. 


6. Click Next. 


The connection wizard passes through four screens: Target Operating System 
Settings, Memory Mapping, Object Path Mappings, and Target State 

Refresh. For the purposes of this chapter you do not need to use these screens. 
Click Next until you come to the Connection Summary, as shown in Figure 5-3. 
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Figure 5-3 Connection Summary 


% New Connection 


Connection Summary 


Please review the connection information 


Connection name: WRProbe_PPC?7SOFX_O 


Summary 


Property Value 


ADDR PRO40310 

(| DESIGNATORMAP 
DEVICE Wind River Probe 
NAME_MAPPING [*;*.unstripped],[*;*] 
PATH_MAPPING {Jd 
STYLE USBDEVICE 


Immediately connect to target if possible 


7. Make sure that the Immediately connect to target if possible checkbox is 
selected and click Finish. 


Workbench creates a target connection called WRProbe_PPC750FX in the Target 
Manager view. 


8. Inthe Target Manager view, click on the “+” sign next to the 
WRProbe_PPC750FX target connection name to expand it. 


Before Workbench can actually talk to the processor on the target system, 
Workbench must attach to the core. 


9. Right-click on PPC750FX [connected - stopped] and select Attach to Core. 


Workbench is now attached to the core, and able to talk to the processor. 
Workbench switches to displaying the Device Debug perspective. 
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Figure 5-4 


5 OCD Connections 
5.2 Creating a Target Connection 


In the Workbench toolbar, select Window > Show View > OCD Command Shell. 
The OCD Command Shell opens, as shown in Figure 5-4. 


OCD Command Shell 


Tasks Problems Properties Build Console Error Log Terminal 0 Trace 
Connected to PPC750FX] 


The prompt in the OCD Command Shell will read either >BKM> (background 
mode) or >ERR> (error.) 


There are several reasons an >ERR> prompt might appear; these will be addressed 
further on. 


The next step is to configure the emulator by setting certain configuration options, 
as described in 6. Tool Configuration. 
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6.2 Tool Configuration 34 


6.1 Introduction 


Wind River emulators can be configured in several different ways to specify 
various settings such as electrical properties, connection logic, and clock rate. To 
configure these settings Workbench uses configuration options, or CF options, which 
can be set in the OCD Command Shell. 


This document only describes the most important CF options, ones that are 
common to all Wind River-supported processor families. For a full description of 
all Wind River CF options sorted by processor family, see the Wind River Workbench 
On-Chip Debugging Configuration Options Reference. 
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6.2 Tool Configuration 


At the prompt in the OCD Command Shell (either >BKM> or >ERR>) enter the 
command CF with no arguments. 


This displays a list of all CF options available for your target processor, along with 
their current settings. 


>ERR>cf 

Set BreakPoint SB[SB,IHBC] = SB 

Vector Table Location VECTOR [HIGH, LOW, IGNORE] = LOW 

Monitor Target reset RST[YES,NO,HALT,RUN] = YES 

Target CPU TAR[AUTO, 603E, EC603E, 603P,603R,740,745, 

750,750CX, 750CXE, 750FX, 750GX,755,7400,7410] = 750FX 

Target CPU( SLAVE ) SLAVE [NONE, 8260] = NONE 

Slave IMMR reset value SLIMMRVAL [AUTO, VALUE] = AUTO 

JTAG clock rate (MHz) CLK[0.025...100,AUTO] = 16 
Application IMMR Exclusion Range AIMMRER[OFF,START and END] = OFF 
Application IMMR Value AIMMRVAL[VALUE] = 0e000000 

Real time Preservation RTP[YES,NO] = NO 

Little Endian Mode LENDIAN[YES,NO] = NO 

Processor Mode MODE[32,64] = 64 

Download Mode DLD[NORMAL,8] = NORMAL 

Emulator HRESET Control HRESET [ ENABLE, DISABLE] = ENABLE 
Data Parity Checking PAR[YES,NO] = NO 

Set Work Space WSPACE[BASE and SIZE] = 00000000 77c 
Set Stack Range STACK[OFF / LOWER and UPPER] = OFF 
Target Console Redirection TGTCONS [BDM,COM1,COM2] = BDM 

Drive TReset line TRESET[OPENC,ACTIVE] = ACTIVE 
Invalidate Instruction Cache on GO INVCI[YES,NO] = YES 

Reset Pulse Length N*1ms RPL[1..600] = 1 

Sense Power via HRESET SPOWER[YES,NO] = YES 

Power On Reset Length N*1ms PONR[O0..500] = 0 

CPU Reset Type RESET [HRESET, SRESET, HRESET_UNFILTER, 

SRESET_UNFI J ESET 

Trap exception TRPEXP[YES,NO POINTONLY] = YES 
Issue an IN on coldstart INCOLD [YES , NO] E 

Display L2 Data Cache Warning L2WARNING[YES,NO] = NO 

Memory Management Unit Mode MMU [ENABLE,DISABLE] = DISABLE 

Load Boot Table On IN BL[ENABLE, DISABLE] = DISABLE 
Trigger In Report Mode BRKREP[REPONLY,BRKREP] = BRKREP 
TMD Mode TMD [ENABLE, DISABLE] = DISABLE 

Run Counter Length RCL[1000..FFFF] = 1000 

Delay after Reset Nms DRST[0..10000] = 25 


6.2.1 Clock Rate 


The CLK option controls the rate at which the JTAG clock (or BDM clock) clocks 
debug commands to the target. 
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Available clock rates, and default settings, vary between processor families. Enter 
CF at the prompt and look for CLK in the list of CF options to see the available clock 
rates for your target. 


For a PowerPC 750FX target, the available rates (shown above) range from 0.025 to 
100. The default is 16. To change the clock rate, say from 16 to 32, use the following 
command: 


>ERR>cf£ clk 32 


6.2.2 Drive TRESET Line 


The TRESET option controls the logic applied to the target reset (TRESET) signal 
on the target. 


The option can be set to OPENC or ACTIVE. It is set to ACTIVE by default. 


When set to ACTIVE, the emulator uses transistor-transistor logic (TTL.) The 
emulator drives the TRESET signal to both active and inactive states. On some 
targets, the conditioning resistors cause excessive rise or fall time on the signal 
when returning to an inactive state. This excessive time can cause the processor to 
come out of reset in an incorrect state. 


When set to OPENC, the emulator uses open-collector logic. The active driver is 
released by tri-stating the line and allowing conditioning resistors on the target to 
return the signal to the non-active state. 


If you are driving the TRESET signal with an external line, you should set the 
emulator to use open-collector logic. Otherwise you could have an external line 
driving the TRESET signal LOW while the emulator is driving it HIGH, thus 
causing bus contention and possible damage to the target or the emulator. 


To set the TRESET option to OPENC, use the following command: 
>ERR>cf£ treset openc 
To change it back, use the following command: 


>ERR>c£ treset active 
6.2.3 Monitor Target Reset 


The emulator continuously monitors the TRESET signal. If a target reset occurs, 
one of the following actions may be taken: 
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« YES - If a target reset occurs it is reported to the user, and the target is forced 
out of background mode. 


" NO-Ifa target reset occurs it is ignored. This is normally used if the code 
contains a reset instruction, which causes a reset to the external hardware, but 
does not reset the core. 


« HALT - Ifa reset occurs, the target is trapped at the restart vector. 
« RUN-Ifareset occurs, the target is restarted and remains in background mode. 


By default, this option is set to YES. When set to YES, the target will start running 
code after each reset. If you are doing low-level work -- for example, if you are 
examining register settings -- you may want the target to halt after a reset so you 
can get a target snapshot. To set this option to halt the target on a reset, use the 
following command: 


>ERR>cf£ rst halt 
To change it back, use the following command: 


>ERR>cf£ rst yes 


6.2.4 Emulator HRESET Control 


By default, the emulator asserts the hardware reset (HRESET) signal when 
initializing the hardware. 


To configure the emulator not to assert the HRESET signal when it initializes the 
board, use the following command: 


>ERR>cf£ hreset disable 
To change it back, use the following command: 


>ERR>cf hreset enable 


6.2.5 CPU Reset Type 


As stated above, the emulator asserts the hardware reset (HRESET) signal when 
initializing the hardware. You can configure the emulator to assert the software 
reset (SRESET) signal on an initialization instead. 


To configure the emulator to assert the SREST signal instead of the HRESET signal 
when it initializes the board, use the following command: 


>ERR>c£ reset sreset 
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To change it back, use the following command: 
>ERR>cf£ reset hreset 


You can also set this option to HRESET_UNFILTER or SRESET_UNFILTER. With the 
_UNFILTER argument added, The emulator will not sample the reset signal when 
it initializes the board. 


6.2.6 Saving Changes 


Most changes to configuration options do not take effect until you initialize the 
board, as described in 7. Board Initialization. 


37 


Wind River 
Board Bring-Up Guide, 1.0 


38 


7k 
Tod 
oe 
7.4 


Board Initialization 


Introduction 39 
Background Mode 40 
The INN Command 43 
Registers 43 


7.1 Introduction 


In order to establish communications with your target, you must first initialize it. 
Also, if the code you are running on your target causes the connection to be lost, 
you must initialize the target to restore that connection. Initialization is also 
required if you change the register settings in the emulator and want them to be 
reflected in the target. 


The target is initialized whenever you first establish a connection using your 
emulator. If you need to initialize the target when you are debugging, you can do 
it using the IN or INN initialization commands, as described in this chapter. 


39 


Wind River 
Board Bring-Up Guide, 1.0 


7.2 Background Mode 


In order for the emulator to work with the target, it must stop the target CPU and 
put the target in background mode. When the target is in background mode, a 
>BKM> prompt appears in the OCD Command Shell. 


If an >ERR> prompt appears in the OCD Command Shell, the target is not in 
background mode. 


7.2.1 The INCommand 


The IN command does two different things. First, it places the target board into 
background mode. Second, it copies all of the register information that is stored in 
the emulator’s NVRAM down to the target. 


To initialize the board and enter background mode, enter the following command: 
>ERR> in 


The IN command may fail for several reasons. For example, if you have not 
connected power to the target board, the output will resemble the following: 


>ERR>in 

KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KK KEK KKK KKK KKEKKKKK KKK 
Wind River Probe Initialization Sequence. 

Copyright (c) Wind River Systems, Inc. 1999-2005. All rights reserved. 


KOR KKK KR KKK KK KR KKK KK KK KKK KK KK KKK KK KKK KK KKK KK KK KKK KKK KK KKK KKK KKK KKK KK KK KKK KKK KKK 


Support Expires....... 4/20/06 

Target Processor...... PPC750FX:U1 
Wind River Probe Group ID#= 0 
Wind River Probe Serial#= U1234567 Firmware= pr3.3_qa6 
Type CF For a Menu of Configuration Options 
Initializing Background Debug Mode.............. Failed 
Testing Communications to Hardware Interface....Passed 
Deiving HRESET to be High. c.«.6c4 e264 sae eee ae Passed 
Deriving HRESET to be: LOW..c.sesaesee sees edvww see Passed 
Waiting HRESET Low Acknowledge...............5.- Failed 
>ERR> 


For a list of the tests the emulator runs during an IN sequence, see 7.2.2 Set Verbose 
On, p.40. 


7.2.2 Set Verbose On 


To see the tests the emulator is running while attempting to enter background 
mode, put the emulator in verbose mode using the following command: 
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>ERR>set verbose on 
Then enter the IN command again. 


Here is a brief description of the tests with some possible reasons why each test 
would fail. 


Testing Communications to Hardware Interface 


This tests the hardware connectivity, and examines the communications path 
between the host and the emulator. If the test fails, ensure that you have the power 
properly connected and turned on, that the emulator is correctly connected to the 
host computer, and that your emulator hardware is properly connected to the 
target. 


Driving HRESET to be High 


This function tests the RESET signal to verify that it is HIGH. The emulator is not 
driving the RESET signal during this test, so the target must drive the RESET signal 
via a pull-up resistor. If this test fails, check to see if the target board has a pull-up 
resistor on the RESET signal to the HRESET pin of the connector. Also, check the 
target board reset logic and verify that it is not continually driving RESET LOW. 


Driving HRESET to be Low 


The RESET signal is a bi-directional signal for your unit. The emulator drives the 
RESET signal LOW and clocks it back in to verify that it is LOW. If this test fails, 
you may have contention on your RESET signal. Check to see if a device on your 
target board is continually driving RESET HIGH. Verify that the device on your 
target board that is driving the RESET signal is an open-collector device with a 
pull-up resistor. 


Attempting JTAG communication 


During this test, the emulator stops the processor and attempts to establish JTAG 
communications. If this fails, check to see that your hardware is connected 
properly, and that the tests preceding this one passed accordingly. It is also possible 
that there is contention on your board. 


Waiting for HRESET to be Released 


The emulator only drives RESET low for a specified period of time. After RESET is 
driven LOW for the allotted time, it tri-states the RESET driver and clocks the 

RESET signal back in to see if the RESET signal went high. It continues to check for 
RESET to go high until is sees it go high or until you type Ctrl+X. If this test fails, 
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check to see if your target board reset logic is still driving the RESET signal LOW. 
Also check that your target board has a pull-up resistor to drive RESET HIGH. 


Testing for target STOP State 


This test verifies that the processor stopped during the preceding JTAG 
Communications test by polling the processor status. If the target is still running, 
this test fails. 


Comparing Target CPU With CF Setting 


This test verifies that you are properly configured for the appropriate target 
processor by comparing the processor type on your target with the processor type 
specified in your board file. If the test fails, use the CF TAR command to properly 
configure your target. For example, if you are using a PPC750FX target, and this 
test fails, enter the following commands: 


>ERR>cf tar 750fx 
>ERR>in 


Attempting to Locate IMMR register 


This test only completes for PowerPC 82xx targets. It attempts to verify the location 
of the IMMR register, which serves as a pointer to all of the other registers. If it fails, 
none of the internal registers are accessible. If the test fails, check the reset 
configuration word, located in Flash, and ensure that it is set to the correct value. 
To find the correct value for the reset configuration word for your target, see your 
target’s target.ref file, located in installDir/vxworks-6.x/target/config/your Target. 


Loading Internal Registers 


Once background communications are established, the emulator downloads 
register values from the debugger NV-RAM to the target. It will only download 
register values for those register groups that are enabled. If this test fails, see the 
information in 7.3 The INN Command, p.43. 


Testing JTAG Communication 


This test examines the JTAG communication between the emulator and the target 
using the internal clock rate for which the emulator is configured. If this test fails, 
set the internal clock to a lower rate using the following command: 


>ERR>c£ clk value 
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Attempting to restore CPU context 


This test restores the processor scan chains. 


7.3 The INN Command 


In order to get a processor into background mode, the emulator asserts the RESET 
line of the processor and then releases it. The processor and its peripherals on the 
target board are forced into their reset state, and all of the internal registers are 
forced to their manufacturer’s reset value. 


The INN command places the target in background mode without overwriting the 
target’s registers, leaving them in their default reset state for the processor. 


If the IN command fails to put the target in background mode, enter the following 
command: 


>ERR>inn 

KKK KKK KKK KEK KK KKK KKK KKK KEK KKK KKK KKK KEK KEK KEK KK KK KEK KEK KK KK KKK KKK KEK KEKE KKK KKK KKKKEKKAKK 
Wind River Probe Initialization Sequence. 

Copyright (c) Wind River Systems, Inc. 1999-2005. All rights reserved. 


KR KK KK KKK KK KK KKK KK KK KKK KK KK KKK KKK RK KK KK KK KKK KKK KKK KK KKK KKK KKK KR KKK KKK KKK KKK KKK 


Support Expires....... 4/20/06 
Target Processor...... PPC750FX:U1 
Wind River Probe Group ID#= 0 
Wind River Probe Serial#= U1234567 Firmware= pr3.3_qa6 
Type CF For a Menu of Configuration Options 
Initializing Background Debug Mode.............. Successful 
>BKM> 
Generally, if an IN command fails but an INN succeeds, it is usually caused by 


incorrect register values in the emulator's NVRAM. 


To configure register values, see 7.4 Registers, p.43. 


7.4 Registers 


Your emulator includes an area of non-volatile memory (NVRAM) where you may 
store register settings for a target. 
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Once the register values are present in NVRAM, they are automatically loaded to 
the target after each cold start, warm start, or IN initialization command. You can 
select which register values are written to the target by enabling and disabling the 
appropriate register groups. 


Wind River uses low-level SCGA commands to configure registers. Since 
configuring registers manually would require entering a large number of SCGA 
commands, Wind River provides register files for many targets. A register file is a 
Workbench-specific script that you can execute in the OCD Command Shell. 


Register files are ASCII files using the extension .reg. For example, the register file 
for the Wind River PPC750FX target is ppmc750fx.reg, located in 
installDir'workbench-2.x/dfw/build/host/registers/PowerPC/7xx/WindRiver_PP 
MC. 


7.4.1 Downloading a Register File 


To download a register file to the emulator, use the following steps: 
1. Inthe OCD Command Shell, click the Settings button. 
The OCD Command Shell Settings dialog appears, as shown in Figure 7-1. 


Figure 7-1 OCD Command Shell Settings 


%) OCD Command Shell Settings 


OCD Command Shell Settings 


PPC?SOFX 


PlayBack File E+\reci 1PowerPCh?x Rive! Cippmc?S0Fx. reales [¥] Display Background Communications 


Input Log File [ v (Append 
FullLog File | | TAppend 


Next to the PlayBack File field, click Browse. 

Navigate to the register file you wish to use and click Open. 
Click OK. 

In the OCD Command Shell, click the Playback File button. 


Ol ee ge. i 
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The register file you selected is downloaded to your target. The commands 
from the file appear in the OCD Command Shell. 


This procedure only sets the register values in the emulator’s NVRAM, not on the 
target. To copy the register values from the emulator to the target, you must 
initialize the target with the IN command: 


>BKM>in 


Only enabled register groups are copied to the target. 


7.4.2 Enabling and Disabling Register Groups 


If you look at the ppmc750fx.reg register file, you will see that it ends with several 
lines that begin CF GRP ENABLED. Registers are stored in logical register groups. 
When you issue an IN command, the emulator only copies down register settings 
for register groups that are enabled. Register groups that are disabled on your 
target do not have register data transferred. 


Disabling a register group enables you to view the target register value, but 
prevents it from being overwritten during target initialization. 


NOTE: If you change a register value directly on the target of a register group that 


is disabled, that register does not get overwritten by the emulator during an 
initialization. Note, however, that the processor may still reset that register value 
to the processor default during a target initialization. 


To enable or disable a register group on your target, use the following steps: 
1. At the >BKM> prompt, type the command CF GRP. 

The first register group appears, as shown below: 

>BKM>c£ grp 


Group (CF GRP (M/S) Name = ENABLED/DISABLED 
CUSTOM (0=Disable 1=Enable) Enabled > 


The name of the register group is displayed, along with its current status 
(either ENABLED or DISABLED). 


2. Type 1 to enable the group or 0 to disable it. 


3. To leave the setting as it is and advance to the next register group, press the 
ENTER key without typing 0 or 1. 


4. Continue through the list of register groups enabling and disabling them as 
required. 
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5. When the register groups are enabled or disabled, type CF UPLOAD GROUP at 
the >BKM> prompt. 


This displays a list of all of the register groups on your target with their current 
settings as shown below: 


>BKM>cf£ upload group 


CF GRP GT64260_CPU ENABLED ; GROUP 
CF GRP GT64260_SDRAM ENABLED ; GROUP 
CF GRP GT64260_DEVICE ENABLED ; GROUP 
CF GRP GT64260_GPP ENABLED ; GROUP 
CF GRP GT64260_MPP ENABLED ; GROUP 
>BKM> 


7.4.3 Modifying Registers Manually 


Wind River supplies register files for Wind River evaluation boards, as well as for 
many third-party target boards. 


If you are using a target for which Wind River does not supply a register file, you 
may have to create one. For instructions on creating register files, see the Wind 
River Workbench On-Chip Debugging Guide: Configuring Registers. 


Remember that the register file sets the register values in the emulator NVRAM, 
not on the target. The emulator copies the values you set in its NVRAM down to 
the target when you initialize the target with an IN command. Without a register 
file, the NVRAM contains default register values, typically made for a Wind River 
evaluation board, which most likely are not suitable for your target. So the IN 
command will not set the target registers properly. 


Some target processors, for instance most PowerPC targets, come with default 
register settings. If your target has default register settings, you can modify the 
registers directly on your on your target manually, at least to the point where you 
can download your boot ROM application code. 


Remember that if you modify your registers manually, any initialization command 
or target reset will overwrite your changes. 


To modify registers manually, use the Registers view in Workbench. The Registers 
view lets you view the bit-level detail for each register. The following sections 
describe the Registers view and the bit-level detail provided. 


The Registers View 


When the Registers view is open in Workbench, all of the register groups for your 
target are displayed with + signs beside them. Clicking on a + sign expands the 


46 


Figure 7-2 


7 Board Initialization 
7.4 Registers 


register group, showing all of the registers that are included in that register group 
along with the value that they are currently set to. An example of an expanded 
register group is shown in Figure 7-2. 


Expanded Register Group 


Local Yariables Memory 3B Registers x 


a a 


Name Enabled Value En 
+ GPR 
+ CTRL 
+ MMU 
+ FPU 
= 
=] ictc oxo0000000 
FI ox00 
E Ox0 
pmel 0x00000000 
pmc2 ox00000000 
pmc3 oxo0000000 
pmct+ ox00000000 
+ mmerO ox00000000 
+ mmert O0x00000000 
sia oxooo00000 
+ L2CACHE 
+ THERMAL 


< 


NOTE: Figure 7-2 is only an example of an expanded register group. The groups 


and the register values vary widely depending on your target architecture. 


Bit-Level Detail 


You can view the bit-level detail for any register by clicking on the + sign beside 
the register in the register group. 


NOTE: Before you can make any changes to your register settings, you need to 


enable the register group that contains the register you want to modify, so that the 
values download to the target when you initialize your system. If you do not 
enable the register group, you can still modify the settings in the emulator but not 
on the target. For more information, see 7.4.2 Enabling and Disabling Register 
Groups, p.45. 
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You can make changes to any of the register settings by modifying each of the 
bit-level settings for any register. 


To modify bit-level values for your target, complete the following steps: 
1. Inthe Registers view, double-click on the name of the register you wish to edit. 


This opens the Properties view, which shows the name of the register you have 
selected under the Property heading and its current setting under the Value 
heading, as shown in Figure 7-3. 


Properties View 


Disable instruction cache throttling 
obo 

0 

oo 


2. Select the value under the Value heading and edit it as necessary. 


3. Inthe Registers view, click the Refresh Values icon. The register information 
reappears with your changes. 


NOTE: Some registers are write-protected and cannot be edited. 


For more information on registers, including creating custom registers and register 
groups, see the Wind River Workbench On-Chip Debugging Guide: Configuring 
Registers. 


When you have initialized your target and entered background mode, with a 
>BKM> prompt showing in the OCD Command Shell, you can proceed to test your 
hardware, as described in 8. Verifying Hardware. 
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8.1 Introduction 


This chapter describes several tests and diagnostics you can use to verify that your 
hardware is working correctly. 


8.2 Setting a Workspace 


The workspace is an area of RAM on the target that the emulator uses to download 
the hardware diagnostic routines and flash programming algorithms. 


You must tell your emulator where writable RAM is located on your target for this 
purpose. 
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Depending on the device family and type, this space is limited to under 2 KB. Note 
that more memory improves the speed of programming. 


To configure the workspace, enter the parameters using the syntax 
CF WSPACE base size 


where base is the start address, and size is the minimum number of bytes of target 
RAM required. 


To find the base and size values for your target, consult your target’s target.ref file, 
located in installDir/vxworks-6.x/target/config/yourTarget. 


For a Wind River PPC750FX target, the base of the workspace is 00000000 and the 
size is 6000. To set the workspace, enter the command 


>BKM>cf£ wspace 0 60000 


This sets the workspace at address 0 with a size of 0x00006000 bytes. 


8.3 Diagnostic Functions 


Wind River Workbench provides a set of RAM and bus diagnostics and utilities 
that can be controlled by the emulator or run on the target. 


Some of the following tests can run code directly on the target instead of through 
the emulator by selecting the Run on Target checkbox. This allows the test to run 
at the execution speed of the target processor. 


8.3.1 Simple RAM Test 


This test writes and reads back a simple pattern to the memory bounded by the 
starting and ending addresses entered in the Start Address and End Address 
fields. If an error occurs, the test stops and the error type and address are displayed 
in the Output field. 


The first diagnostic to be run is a Simple Ram Test on the area of memory used by 
the workspace. 


1. In the Workbench toolbar, select Window > Show View > Hardware 
Diagnostics. 
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In the Diagnostic field, select Simple RAM Test — Single Pass. 


The workspace cannot be used to test itself, so make sure the Run on target 
checkbox is unchecked. 


In the Start Address field, enter 0. 
In the End Address field, enter 6000. 
In the Units field, select LONG. 
Click Run. 


Workbench displays the test result in the Output field. The output of a successful 
test will resemble that in Figure 8-1. 


Successful Simple RAM Test 


Tasks Problems Properties Build Console Error Log OCD Command Shell © Hardware Diagnostics * 


Choose Diagnostic 
Diagnostic 


Simple RAM test - Single pass 


Description 


he Single RAM Test Single Pass writes and reads back a 
imple pattern to the memory bounded by the starting 
ind ending addresses entered in the fields below, IF an 
rror occurs, the test stops and the error type and 
ddress will be displayed. 


Start address: | oxoo000000 
End address: | oxoo006000 


Units |LONG 


{JRun on target 


Output 


imple ram test running 
est complete 


If the test fails, the Address Bus Test diagnostic and the Data Bus Test diagnostic 
may determine the cause of the failure; see 5.3.5 Bus Tests, p.54. 


If the RAM test of the memory used by the workspace passed, the rest of the 
memory in the target system can now be tested at full bus speed. 


1. 


2 
3. 
4 


In the Diagnostic field, select Simple RAM Test — Single Pass. 


Select the Run on Target checkbox. 


In the Start Address field, enter 14000. 
In the End Address field, enter 20000000. 
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5. Inthe Units field, select LONG. 

6. Click Run. 

Workbench displays the test result in the Output field. 

If the message Test Complete appears, then the diagnostic passed. 


If the test fails, try re-seating the SDRAM module and repeat the test. If the test still 
fails, then run the Address Bus Test diagnostic and the Data Bus Test diagnostic 
to determine the cause of the failure. See 8.3.5 Bus Tests, p.54. 


8.3.2 Full RAM Tests 


A Full RAM test writes a “walking” 1 on each bit of RAM and reads it back. This 
is a very lengthy test and can detect bus configuration errors, typically on a new 
printed circuit board. 


This test sets and then clears each bit to try to locate memory defects bounded by 
the starting and ending addresses entered in the Start Address and End Address 
fields. If an error occurs, the test stops and the error type and address will be 
displayed in the Output field. 


NOTE: A complete Full RAM test would take several years to finish, so make sure 
you specify a very small region of memory to be tested. 


Full RAM tests are designed to check for cell disturbance and addressing 
problems. These tests perform the following actions: 


A Single Pass test will run the test only once. A Continuous test will repeat the test 
over the same address until you click Stop. 


1. Inthe Diagnostic field, select Simple RAM Test - Single Pass. 
2. Select the Run on Target checkbox. 

3. Inthe Start Address field, enter 0. 

4. Inthe End Address field, enter 0000100. 

5. Inthe Units field, select LONG. 

6. Click Run. 

Workbench displays the test result in the Output field. 

If the message Test Complete appears, then the diagnostics passed. 
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If the test fails, try re-seating the SDRAM module and repeat the test. If the test still 
fails, then run the Address Bus Test diagnostic and the Data Bus Test diagnostic 
to determine the cause of the failure. See 8.3.5 Bus Tests, p.54. 


8.3.3 CRC Calculation 


Workbench and the emulator support the calculation of a Cyclic Redundancy 
Check (CRC) on all addresses in the range specified. The CRC test will checksum 
a block of data in the target for the address range you specify in the CRC 
Calculation dialog. The CRC algorithm is based on the following polynomial: 


x16 + x415 + x42+1 
Workbench uses this polynomial as follows: 


Workbench reads a location and uses the value read, x, to calculate the CRC. Then 
Workbench adds the result to the value calculated for the previous address. This 
process continues until Workbench has checked the entire specified memory 
range. 


The CRC sum will be returned if the communications with the emulator and target 
are working. To interrupt the test, click Stop. 


8.3.4 Scope Tests 


Read From Location 


The Read From Location Scope Test performs a memory read of designated length 
from the address entered in the From Address field. 


Write To Location 


The Write To Location Scope Test performs a memory write of designated length 
of the value entered in the Data Value field to the address in the To Address field. 
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Write and Complement 


The Write and Complement Scope Test performs a memory write of designated 
length of the value entered in the Data Value field to the address in the To Address 
field; the value is then complemented. 


Write Rotating Value 


Write Then Read 


The Write Rotating Value Scope Test performs a memory write of the value entered 
in the Data Value field to the address in the To Address field. The value is then 
rotated through all of the bit positions with respect to the designated length of the 
memory address. 


The Write and Read Scope Test performs a memory write of designated length of 
the value entered in the Data Value field to the address in the To Address field; the 
value is then read back. 


8.3.5 Bus Tests 


Address Bus Test 


Data Bus Test 


This test detects faults in the address bus over the range bounded by the starting 
and ending addresses entered in the Start Address and End Address fields. This 
test can be interrupted by clicking the Stop button. 


This test detects faults in the data bus over the range bounded by the starting and 
ending addresses entered in the Start Address and End Address fields. This test 
can be interrupted by clicking the Stop button. 


When you have tested your hardware successfully, you must test your ability to 
read and write memory, as described in 9. Testing Memory. 
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9.1 Introduction 


Before handling more complex application code, the target system must be able to 
handle low-level assembly instructions. 


Wind River Workbench includes a simple diagnostic to test the target’s ability to 
write to memory, set breakpoints, and run and step code. This diagnostic writes a 
loop of NOP instructions at a specified memory address. 


9.2 Testing Memory 


To run the memory diagnostic, use the following steps. 
1. At the >BKM> prompt in the OCD Command Shell, enter DF E 14000. 
This writes a NOP loop at address 0x14000. 


55 


Wind River 
Board Bring-Up Guide, 1.0 


2. Enter the command DI 14000. 

This command disassembles the instructions at 0x14000. 
3. Enter the command SR PC 14000. 

This command sets the Program Counter to address 0x14000. 
The output should resemble that shown below. 


>BKM>df e 14000 


>BKM>di 14000 
$00014000 : 0x60000000 :ppc nop 
$00014004 : 0x60000000 :ppc nop 
$00014008 : 0x60000000 :ppc nop 
$0001400C : 0x60000000 :ppc nop 
$00014010 : Ox7COOO04AC :ppc sync 
$00014014 : Ox4BFFFFFO :ppc b 0x14004 
$00014018 : 0x00000000 :ppc dc.1 0x0 
$0001401C : 0x00000000 :ppe dc.1 0x0 
$00014020 : 0x00000000 :ppe dc.1 0x0 
$00014024 : 0x00000000 :ppe de.1 0x0 
$00014028 : 0x00000000 :ppe dc.1 0x0 
$0001402C : 0x00000000 :ppc dc.1 0x0 
$00014030 : 0x00000000 :ppe dce.1 0x0 
$00014034 : 0x00000000 :ppe de.1 0x0 
$00014038 : 0x00000000 :ppc dc.1 0x0 
$0001403C : 0x00000000 :ppce dc.1 0x0 
$00014040 : 0x00000000 :ppe de.1 0x0 
$00014044 : 0x00000000 :ppec de.1 0x0 
$00014048 : 0x00000000 :ppc dc.1 0x0 
$0001404C : 0x00000000 :ppc dc.1 0x0 

>BKM>sr pce 14000 

>BKM> 


Now there is a simple program in the target’s memory, and the Program Counter 
has been set to 0x14000. 


9.2.1 Stepping an Instruction 


First, test to see if the system can handle the step instruction command. 
In the Debug view, click the Step Into button. 


The Disassembly view opens, with the Program Counter now at 14004, as shown 
in Figure 9-1. 
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Figure 9-1 Disassembly View 


|C) diabasm.s | {C) cdemo.c | \C) strutils.c \C) calendar.c WRProbe_PPC7SOFX 5% 
‘System Context 
> 00014004: nop hed) 
00014008: nop 
0001400c: nop 
00014010: sync 
00014014: b Ox14004 
00014018: .- long in) 
0001401c: . long in) = 
00014020: - long in) 
00014024: - long o 
00014028: . long Oo 
0001402c: . long in) 
00014030: . long in) 
00014034: - long ia) 
00014038: - long in) 
0001403¢: - long in) 
00014040: - long Oo 
00014044: . long o 
00014048: . long in) 
0001404c: . long in) 
00014050; - long ia) 
00014054: . long in) 
00014058: . long in) 
000140S5e: - long in) 
00014060: .- long ia 
00014064: - long Oo 
00014068: . long in) 
0001406c: - long oO wi 
nantanzne Lene 9. pe] 


Also, the System Context in the Debug view now reads 0x14004, as shown in 
Figure 9-2. 


Figure 9-2 System Context 


© Debug X 


o> “ 
i= &} WRProbe_PPC?S50Fx [Attach to Target] 
=)? PPC750FX (System Mode) 
=) a System Context (Stopped - Step End) 
oO pre 
14004 
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9.2.2 Running Code 


Next, test to see if the processor can run the simple program at full bus speed. 


In the Debug View, click the Resume button to start the target. In the Debug view, 
the System Context changes to Running, and a >RUN> prompt appears in the 
OCD Command Shell. 


Wait a few seconds and then click the Suspend button to stop the target. In the 
Debug view, the System Context changes to Stopped -- User Request, as shown 
in Figure 9-3. 

Figure 9-3 System Context 


® Debug X 


o> by 22 Rk B= 
5 &} WRProbe_PPC?S50FX [Attach to Target] 
Se ad PPC?50FX (System Mode} 
5 By System Context (Stopped - User Request) 
8 0x14010 


Also, the Disassembly view updates to show the new location of the Program 
Counter, as shown in Figure 9-4. 
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Figure 9-4 Program Counter at 14010 


(C) diabasm.s C) cdemo.c IC) strutils.c \C) calendar.c 52 WRProbe_PPC7SOFX 53 
System Context 
00014004: nop a 
00014008: nop 
0001400c: nop 
> 00014010: sync 
00014014: b 0x14004 
00014018: - long oO 4 
0001401c: . long 0 
00014020: » long O 
00014024: . long oO 
00014028: . long 0 
0001402¢c: . long in) 
00014030: . long oO 
00014034: . long oO 
00014038: » long ia) 
0001403c: . long oO 
00014040: . long oO 
00014044: » long in) 
00014048: . long oO 
0001404c: . long 0 
00014050: » long ia) 
00014054: . long oO 
00014058: . long oO 
0001405c: . long ia) 
00014060: . long oO 
00014064: . long oO v 


9.2.3 Setting Software Breakpoints 


Next, test to see if the target can set a software breakpoint. 


In the Disassembly view, double-click to the left of address 0x14008 (in the gutter.) 
Workbench places a software breakpoint at address 0x14008, as shown in 
Figure 9-5. 
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Figure 9-5 Planted Software Breakpoint 


[ |C) diabasm.s | \C) cdemo.c C) strutils.c | |C) calendar.c 
System Context 
00014004: 
Goo014008: 
0001400c: 
® 00014010: 
00014014: 
00014018: 
0001401c: 
00014020: 
00014024: 
00014028: 
0001402c: 
00014030: 
00014034: 
00014038: 
0001403c¢: 
00014040: 
00014044: 
00014048: 
0001404¢c: 
00014050: 
00014054: 
00014058: 
0001405c: 
00014060: 
00014064: 


oo0oo Coo Oo OmOoooocooc oO oO ec Oo 6 


The breakpoint at address 0x14008 appears in the Breakpoints view. 


Figure 9-6 Breakpoints View 


“© Breakpoints * 


In the Debug view, click the Resume button to start the processor. The program 
will run until it hits the breakpoint. Output appears in the OCD Command Shell, 
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showing that the system has stopped and showing the current location of the 
Program Counter, as shown below: 


>RUN> 


!BREAK! - [msg12000] Software breakpoint; PC = 0x00014008 [EVENT Taken] 
>BKM> 


This output shows that the software breakpoint at address 0x14008 has been hit. 
In the Debug view, the System Context changes to Stopped -- Breakpoint Hit. 


Figure 9-7 System Context 


® Debug * 


Oe i 29 8% B 
= # wRProbe_PPC7SOFx [Attach to Target] 
=) PPC7SOFX (System Mode) 
= a System Context (Stopped - Breakpoint Hit) 
8 0x1 4008 


To remove the software breakpoint, double-click on the breakpoint icon to the left 
of address 0x14008 in the Disassembly view. 


9.2.4 Setting Hardware Breakpoints 


Next, test to see if the system can handle setting hardware breakpoints. 


In the Disassembly view, right-click to the left of address 0x1400C (in the gutter) 
and select Add Hardware Breakpoint. Workbench places an internal hardware 
breakpoint at address 0x1400C, as shown in Figure 9-8. 
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Figure 9-8 Planted Hardware Breakpoint 


[C) diabasm.s | [C) cdemo.c ~—{C) strutils.c |C) calendar.c SE WRProbe_PPC750FX 22 \_ = |) 
System Context 
00014004: nop & 
00014008: nop 
f}0001400c: nop 
00014010: sync 
00014014: b 0x14004 
00014018: . long oO 
0001401c: . long 0 
00014020: . long 0 
00014024: . long 0 
00014028: . long ia) 
0001402c: . long in) > 
00014030: . long in) 
00014034: . long 0 
00014038: . long 0 
0001403c: . long in] 
00014040: . long 0 
00014044: . long ia) 
00014048: . long 0 
0001404c: . long in) 
00014050: . long oO 
00014054: . long 0 
00014058: . long 0 
0001405e¢: . long 0 
00014060: . long is) 
00014064: . long ia) v 


The hardware breakpoint at address 0x1400C appears in the Breakpoints view. 


Figure 9-9 Breakpoints View -- Hardware Breakpoint 


“= Breakpoints * 


a Ox1400c (*Planted*, Hardware,Restricted Scope) 


In the Debug view, click the Resume button to start the processor. The program 
will run until it hits the breakpoint. Output appears in the OCD Command Shell, 
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showing that the system has stopped and showing the current location of the 
Program Counter, as shown below: 

>RUN> 

!BREAK! - [msg11001] Internal hardware breakpoint; PC = 0x0001400c [EVENT 
Taken] 

>BKM> 


This output shows that the hardware breakpoint at address 0x1400C has been hit. 


In the Debug view, the System Context changes to Stopped -- Breakpoint Hit. 


To remove the hardware breakpoint, double-click on the breakpoint icon to the left 
of address 0x1400C in the Disassembly view. 


If all these steps perform successfully, the target can run and debug low-level 
assembly code. The next step is to run and debug application code, as described in 
10. Debugging in RAM. 
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10.1 Overview 


This chapter describes the process of running and debugging application code in 
RAM using Wind River Workbench. 


10.2 Creating a Target Connection 


To download and run code and symbol information, you must have an active 
target connection. 
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To create a target connection, create projects, and download code, you can use a 
Wind River Probe, a Wind River ICE SX, or the Wind River Instruction Set 
Simulator (ISS), which is available to all users of Wind River Workbench OCD 
Edition. 


To create a target connection, use the procedure described in 5. OCD Connections. 


10.3 Creating a Project 


In order to download and run code and symbol information in RAM, you must 
have an active project open. 


Several example projects are included in Wind River Workbench for 
demonstration purposes. To open a new demonstration project, use the following 
steps: 


1. Select File > New > Example. 


The New Example wizard appears, as shown in Figure 10-1. 
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Figure 10-1 New Example Wizard 


% New Example 


Select a wizard 


Creates a new O5S-agnostic sample project 


Wizards; 


=| & Examples 
(0% Embedded Linux Sample Project 
(9 Native Sample Project 
a 
(R@ VxWorks Downloadable Kernel Module Sample Project 
{P% VxWorks Real Time Process Sample Project 
(8 Wind River Linux Sample Project 


Cancel 


2. Select Standalone Sample Project and click Next. 


A sample project template appears, as shown in Figure 10-2. 


67 


Wind River 
Board Bring-Up Guide, 1.0 


Figure 10-2 Sample Project Template 


% New Project Sample 


Sample Project Template 


Select a sample project template. 


Available Examples: Information: 


C Demonstration Program 

(C++ Demonstration Program This program demonstrates various C 

(SB The Ball Demonstration Program language Features including structures, 
(The Panel Demonstration Program character arrays, linked lists, and recursion. 
You can build and download this program 
to your simulator or target board, The 
default RAM location for the program is 
0x00014000, To change the default 
memory address, edit the simple. lk linker 
command File, 


Features 


The Following Features are demonstrated 


3. Click Finish. 


Workbench creates the sample project in the default workspace directory, and 
the project name c_demo_sa appears in the Project Navigator view. 


4. Inthe Project Navigator view, expand the c_demo_sa project. 


A number of available build specs appear. 
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Figure 10-3 c_demo_sa 


@ arm-0x00000000-LE-diab_DEBUG 
@ arM-0x04000000-BE-diab_DEBUG 
@ arM-0x04000000-LE-diab_DEBUG 
@ arm-0x08000000-BE-diab_DEBLIG 
@ arm-0x08000000-LE-diab_DEBUG 
(@ mcF-0x00000000-BE-diab_DEBUG 
@ mcF-0x20000000-BE-diab_DEBUG 
(29 mcF-0x40000000-BE-diab_DEBUG 
(29 mips32-4KEc-BE-16bit-diab_DEBUG 
(29 mips32-4KEc-BE-32bit-diab_DEBUG 
(29 mIpS32-4KEc-LE-16bit-diab_DEBUG 
(29 MIPS32-4KEc-LE-32bit-diab_DEBUG 
te (28 MIPS32-4Kx-BE-32bit-diab_DEBUG 
tH) G2 MIPS32-4Kx-LE-32bit-diab_DEBUG 
4) @22 MIPS32-BCM-BE-32bit-diab_DEBUG 
(4) G29 MIPS32-BCM-LE-32bit-diab_DEBUG 
(4) 22 MIPS32-IDT-BE-32bit-diab_DEBUG 
4-29 MIPS32-IDT-LE-32bit-diab_DEBUG 
(4-29 MIPS32-PHI-BE-32bit-diab_DEBUG 
(4-22 MIPS32-PHI-LE-32bit-diab_DEBUG 
tH GY MIPS32-PNX-BE-16bit-diab_DEBUG 
tH GY MIPS32-PNX-BE-32bit-diab_DEBUG 
(29 mips32-PNX-LE-16bit-diab_DEBUG 
(2? mIPS32-PNX-LE-32bit-diab_DEBUG 
(29 mips32-WISS-BE-32bit-diab_DEBUG 
(29 mips32-WISS-LE-32bit-diab_DEBUG 
(29 mipsé64-20Kc-BE-diab_DEBUG 
(29 mIps64-20Kc-LE-diab_DEBUG 
(29 mIps64-Skc-BE-diab_DEBUG 
(29 mIps64-Skc-LE-diab_DEBUG 
(29 mipsé4-RM9000_P0-BE-diab_DEBUG 
(29 mipsé4-RM9000_PO-LE-diab_DEBUG 
(29 mipsé4-RM9000_P1-BE-diab_DEBUG 
(29 mipsé4-RM9000_P1-LE-diab_DEBUG 
(29 mipsé4-RM9000-BE-diab_DEBUG 
(2 MIPS64-RM9000-LE-diab_DEBUG 
(22 mIPS64-1X49-BE-diab_DEBUG 
tH 28 MIPS64-TX49-LE-diab_DEBUG 
(29 mips64-VR4131-BE-diab_DEBUG 
(29 mips64-VR4131-LE-diab_DEBUG 


2-2 ee ee 


5. To build the sample project, right-click on the c_demo_sa top-level folder and 
select Build Options > Set Active Build Spec. 


The Set Active Build Spec and Debug Mode dialog appears, as shown in 
Figure 10-4. 
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Figure 10-4 Set Active Build Spec and Debug Mode Dialog 


W Set Active Build Spec and Debug Mode 


PPC603diab-WI5S 
MIPS32-4KEc-BE-16bit-diab 
MIPS32-4KEc-LE-16bit-diab 
MIPS32-4KEc-BE-32bit-diab 
MIPS32-4KEc-LE-32bit-diab 
MIPS32-4Kx-BE-32bit-diab 
MIPS32-4Kx-LE-32bit-diab 
MIPS32-BCM-BE-32bit-diab 
MIPS32-BCM-LE-32bit-diab 
MIPS32-IDT-BE-32bit-diab 
MIPS32-IDT-LE-32bit-diab 
MIPS32-PHI-BE-32bit-diab 
MIPS32-PHI-LE-32bit-diab 
MIPS32-PNX-BE- 1 6bit-diab 


Debug mode (use debug mode flags) 


6. Select the build spec for your target family. This document uses the Wind River 
PPC750FX for its examples, so Figure 10-4 shows the PowerPC build spec. 


7. Select Debug mode (use debug mode flags) so Workbench will generate 
symbolic debug information. 


8. Click OK. 
9. Right-click on the c_demo_sa folder and select Build Project. 


Workbench builds the sample project using the Wind River Compiler. The results 
of the project build appear in the Build Console view, as shown in Figure 10-5. 
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Figure 10-5 Build Console View 


Tasks Problems Properties EIS7=1¥)/Tetsi= |) 4 Error Log Terminal 0 OCD Command Shell 4 


s&s & | be &. 
echo “ ‘building PPC603diab | DEBUG iinklist.o";dcc -g -Xdebug-dwart2 -EPPC603ES: simple -DTOOL_FAMILY=diab -DTOOL=d a 
flinklist.o" -c “linklist.c" 
building PPC603diab_DEBUG /linklist.o 
echo "building PPC603diab_DEBUG/date.o";dcc -g -Xdebug-dwarf2 -t-PPC603ES:simple -DTOOL_FAMILY=diab -DTOOL=diz 
e.0" -c "date.c" 
building PPC603diab_DEBUG/date.o 
echo “building PPC603diab_DEBUG/math.o";dec -g -Xdebug-dwarf2 --PPC603ES:simple -DTOOL_FAMILY=diab -DTOOL=di. 
h.o" -c "math.c" 
building PPC603diab_DEBUG/math.o 
echo “building PPC603diab_DEBUG/addone.o";das -tPPC603ES: simple -DTOOL_FAMILY=diab -DTOOL=diab -DPowerPC -D 
building PPC603diab_DEBUG/ addone.o 
echo "building PPC603diab_DEBUG/cdemo.elf"; did -o "PPC603diab_DEBUG/cdemo. elf" --PPC603ES:simple cdemo-POWERF 
3diab_DEBUG/strutils.o PPC603diab _ DEBUG/engineer. o PPC603diab_DEBUG/calendar.o PPC603diab_DEBUG/linklist.o PPC _ 
"4; then echo "building Run plink utility"; plink PPC603diab_DEBUG/cdemo. elf ;Fi 
building PPC603diab_DEBUG/‘cdemo.elf 
make: built targets of C:/WindRiver/workspace/c_demo_sa 
Build Finished in Project "c_demo_sa‘: 2006-05-01 11:05:57 (Elapsed Time: 00:08) 


< Mm | 


NOTE: When using projects other than the supplied demonstration projects: you 


must compile your programs using debugging symbols (the -g compiler option) to 
use most debugger features. The compiler settings used by the Wind River 
Workbench project facility’s Managed Builds include debugging symbols. 


However, Workbench does not support code compiled with -02 optimization. 


10.4 Downloading Code and Symbol Information 


To run the sample code, right-click on cdemo.elf in the Project Navigator view and 
select Reset and Download. 


The Reset and Download view appears, as shown in Figure 10-6. 
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Figure 10-6 Reset and Download 


W WRProbe_PPC750FX - PPC750FX 


Modify attributes and launch. 


Name: | WRProbe_PPC7SOFX - PPC750FX 


@ main |e Reset | @ Download | Instruction Pointer | # Run Options | © Projects to Build | "7 Source | 1 Common 
Connection 
Connection to use: | WRProbe_PPC750FX (localhost) v (Hide unconnected 


opect  WRProbe_PPC7SOFX - WRProbe_PPC7SOFX is connected. 


Core: | PPC7S50F% v| 


Apply Revert 


When opened from this folder, the Reset and Download view is pre-configured for 
this project. 


Leave the settings at their defaults and click Debug. 


The OCD Console view opens, as shown in Figure 10-7. 
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Figure 10-7 OCD Console 


| 2 ES _ 7 7 aT 7 T = 
Tasks | Problems | Properties Build Console Error Log TerminalO Trace OCD Command Shell OCD Console X 


Reset and Download 


Testing Communications to Hardware Interface..., Passed 
Driving HRESET to be High aay Passed 
Driving HRESET to be Low Passed 
Waiting HRESET Low Acknowledge. ‘ag Passed 
Attempting JTAG communication.... Passed 
Waiting for HReset to be released.. ; Passed 
Testing For target STOP State. Passed 
Comparing target CPU with CF setting ai. Passed 
Waiting for HRESET High Acknowledge 7 Passed 
Testing JTAG Communication nH Passed 
Loading Internal Registers.. Passed 
Testing JTAG Communication... a Passed 
Getting value of cf mmu option .. Passed 
Attempting to restore CPU contex' Passed | 
C:\WindRiver\workspace\c_demo_sa\PPC603diab_DEBUG\cdemo. elf COCO 
Loading symbols... Completed at Default Offset (<1 sec) 
Specified not to Run 

* Reset and Download Completed * 

< 


The OCD Console view shows the progress of the download operation, as 
Workbench downloads the sample code to the target. 


The Editor opens showing the Program Counter set at the beginning of the 
application code, as shown in Figure 10-8. 
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Figure 10-8 Editor 


{@ diabasm.s X C) cdemo.c Ic) strutils.c fc) calendar.c 


-ifdef PowerPC 


DeeeeeeeaaeeeeeeeeesKSTAAEKTETEKERKEEEEEREREEREEKEEEEEEREETEEERREEEEEERE 


-section§ .text,,C 
-globl _start, START, ENTRY 
-extern main 


ri1i,r0,__SP_INIT@ha # Initial Stack Pointer 
ri,riil,__SP_INIT@1 


r13,r0, SDA_BASE_@ha # Small Data area 
ri3,r13, SDA_BASE @1 


r2,r0, SDA2_ BASE _@ha # Small Data Area 2 
r2,r2,_SDA2_BASE @1 


rO0,r0,0 # Push O onto stack 
r0,-64(r1} 


main 


deadloop: 
b deadloop 


-globl addone 


You are now ready to run and debug the application. 


10.5 Debugging Code in RAM 


Use the Debug view to monitor, control, and manipulate the processes and tasks 
that you are actively debugging. The Debug view shows only the processes that 
are currently under debugger control. 
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Figure 10-9 Debug View 


® Debug X 
o> by 2@R®Re 


=) &} WRISS_MPC8540 [Attach to Target] 
i MPC8540 (System Mode) 
5 a System Context (Stopped) 


8 start(} - diabasm.s:44 


10.5.1 Monitoring Processes 


When you start processes under debugger control, or attach the debugger to 
running processes, they appear in the Debug view labeled with unique colors and 
numbers. You can change the color assigned to a process or thread by right-clicking 
the process or thread and selecting Color > specific color. 


10.5.2 Stepping Through Code 
The Editor shows the source file diabasm.s, showing the c_demo_sa project’s 
initialization assembly. 
In the Debug view, click the Step Into button. 


The Program Counter moves to the second assembly instruction. If you open the 
Memoty view or the Registers view, you can see them update memory and 
register values as you step through instructions. 


Click the Step Into button seven more times, to step through all the initialization 
code and reach the first branch instruction: 


bl main 
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This is where the application branches out of assembly into C code. 
Click the Step Into button again. 


The application branches into main() and the Editor opens the source file cdemo.c, 
as shown in Figure 10-10. 


Figure 10-10 C Source 


IC) diabasm.s [C) cdemo.c 88 IC) strutils.c 55) WRProbe_PPC7S0FX IC) linklist.c fi 
int initval; /* initialization value for calculation */ A 
char *globalstring[3]; /* Uninitializeded array of string pointers 
char bell[2] = {BELL_CHAR, '\0'}? 


Df/AeeeeAAAAAAAAKARAAAA TEAR AEEAAAALERAAA AER AA AAA AAA ATTRA ATTRA AA ATA A ATES 
Tint main() 
{ 
volatile long demo counter; 


> volatile int pfa_demo=0; 
int sum = 0; 
volatile char cvar; /* sample char variable */ 


REC_TYPE1 q; 
volatile int localiInti; 
volatile long localLong1; = 


/* Setup the global string array */ 


globalstring[0] = "zero"; 
globalstring[1] = "one"; 
globalstring[2] = "two"; 


f* Initialize the rectest structure */ 

rectest.long integer = OxFFFFEEEE; 

rectest.short_integer = 5555; 

rectest.integer_array[0] = 0; 

rectest.integer_array[1] = 10; 

rectest.integer_array[2] = 20; 

rectest.integer array[3] = 30; 

rectest.string pointer = "Wind River's Tool Product Family": 


\< 


10.5.3 Setting a Software Breakpoint 


Breakpoints allow you to stop a running program at particular places in the code 
or when specific conditions exist. For a full explanation of Workbench breakpoints, 
see B. Internal Breakpoint Capabilities. 


In the left ruler of the Editor (the gutter), double-click to the left of the source line 


globalstring[2] = “two”; 
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This sets a software breakpoint on that source line. The breakpoint appears in the 
Breakpoints view. 


Figure 10-11 Planted Software Breakpoint 


*» Breakpoints X 


In the Debug view, click the Resume button. The program runs until it hits the 
breakpoint. The System Context changes to Stopped -- Breakpoint Hit. 


Figure 10-12 System Context -- Stopped 


® Debug X 


o> by 28 eR = 
2 &} WRProbe_PPC?S0Fx [Attach to Target] 
9" PPC7SOFX (System Mode) 
=| a System Context (Stopped - Breakpoint Hit) 
| 


a maint) - cdemo.c:113 


= diabasm.s:58 


Breakpoint information also appears in the OCD Command Shell: 
>RUN> 


!BREAK! - [msg12000] Software breakpoint; PC = 0x00014074 [EVENT Taken] 
>BKM> 


10.5.4 Running a Program 
To run your downloaded program, click Resume in the Debug view. The program 


will run until it hits a breakpoint. If there are no breakpoints or interrupts, the 
program will run to completion or until you click Suspend. 
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When the program is running, the System Context changes to Running, as shown 
in Figure 10-13, and a >RUN> prompt appears in the OCD Command Shell. 


Figure 10-13 System Context -- Running 


® Debug X 
00 ty 


= &} WRProbe_PPC?S50Fx [Attach to Target] 
PPC7S0FX (System Mode) 
System Context (Running) 


If there are no breakpoints, you can stop the program by clicking the Suspend 
button in the Debug view or by entering the HA command at the >RUN> prompt 
in the OCD Command Shell. 


The Editor updates to show the current location of the Program Counter and the 
System Context in the Debug view changes to Stopped -- User Request. 


Figure 10-14 System Context -- Stopped 


® Debug X 


o> oy 23.2 «= 
=) #9 wRProbe_PPC7SOFX [Attach to Target] 


)-@ PPC?SOFX (System Made) 
=) cy System Context (Stopped - User Request) 


8 dayOFYear() - calendar.c:213 
= calendar() - calendar.c:122 
=" main() - cdemo.c:184 

=" diabasm.s:58 


10.5.5 Stepping Through a Program 


To single-step without going into other subroutines, click Step Over instead of 
Step Into. 


While stepping through a program, you may conclude that the problem you are 
interested in lies in the current subroutine’s caller, rather than at the stack level 
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where your process is suspended. In this situation, if you click Step Return, 
execution continues until the current subroutine completes, then the debugger 
regains control in the calling statement. 


10.5.6 Setting a Hardware Breakpoint 


The availability of hardware breakpoints varies by architecture. You can only set 
as many hardware breakpoints as there are debug registers available on your 
target. 


Once a hardware breakpoint is trapped, the debugger will behave in the same way 
as for a standard breakpoint and stop for user interaction. 


For a full description of hardware breakpoints in Workbench, see B. Internal 


Breakpoint Capabilities. 
In the Breakpoints view, click on the Menu button and select Add Data 
Breakpoint. 


The Data Breakpoint dialog appears, as shown in Figure 10-15. 


If an error message appears, you may have exceeded the number of allowed 
hardware breakpoints (four for most targets). Right-click in the Breakpoints view 
and select Remove All. Then select Menu > Add Data Breakpoint again. 


If an error message still appears, your target may not support hardware 
breakpoints. 
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Figure 10-15 Data Breakpoint Dialog 


% Data Breakpoint Properties 


Breakpoint Address and General Attributes 
@ Please specify Address Expression 


Select debug target for target-specific information 
@ PPC7SOFX 
None - preserve current settings 


“9 General Status Scope @ Hardware 


Address Expression | | 7 


[_] Continue on Break 


Continue Delay (ms) | 


Cancel 


You can use data hardware breakpoints to find out which routines are modifying 
a specific variable. 


The Address Expression can be a symbol or a specific address in hex. You can use 
the address 0x0 in the Address Expression field to set a data hardware breakpoint 
to catch null pointers. You can set the Address Expression field to an address in 
the stack area to set a data hardware breakpoint to find out if the stack grew to that 
point. 


The following example sets a symbol in the Address Expression field. 
1. Click Browse. 


The Select Symbol dialog appears, showing a list of available symbols that can 
take a hardware breakpoint. 
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Figure 10-16 Select Symbol 


% Select a symbol 


Choose the symbol from the list. Debug symbols can only be 
retrieved if there is an active debug session 


Debug target 
4 PPC7SOFX 


Filter (regular expression) 


Matching symbols 


® send_month - globalfunction 
® SeniorTestEngineer - globalyariable 
status - globalyariable 

strcmp - globalfunction 

strcpy - globalfunction 
swapCells - globalfunction 
test_engineer - globalyariable 
testBits - globalyariable 
TestEngineer - globalvariable 
wait_count - globalvariable 
wait_index - globalvariable 
year 1997 - globalvariable 


Cancel 


10 Debugging in RAM 


10.5 Debugging Code in RAM 


2. Scroll down and highlight the symbol wait_index. 


3. Click OK. 


The global variable wait_index is now the address for the data hardware 


breakpoint. 


The hardware breakpoint on wait_index appears in the Breakpoints view. 
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Figure 10-17 wait_index 


*« Breakpoints * 


In the Debug view, click Resume. 


The program runs until it hits the hardware breakpoint. Workbench halts the 
processor when it locates wait_index and displays that source line in the Editor. 
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Figure 10-18 Hardware Breakpoint Hit 


iC) cdemo.c 58 [C) strutils.c | {C) calendar.c 2) =O] $F Debug 2% - >is 
a od 
globalLongl = calendar( localLongl }; o> Nw 2@& & eo 
, 2f@ 8B 
+ ft i - 
q.a = 55; 


i ate = & WRProbe_PPC?50Fx [Attach to Target] 
strepy(q.b,"December") ; lw? PPC7SOFX (System Made) 

q.c = 12345678L; =) #4) System Context (Stopped - Breakpoi 
q.color = red; =" main() - cdemo.c:195 


=" diabasm.s:58 


sum = 0; 
> wait_index = 0; 
wait _count = 5; < il | > 
quick index = 5; / = i 
a |®o Breakpoints 53 —\/ 
recordvar.color = red; 4 x 7) €@#o: x. | Fea & a 
ng 3 [¥] % wait_index (*Planted*, Restricted Scope} 10 
+ * 


while (wait_index < wait_count) 
{ 


wait_index = addone(wait_index); v 
a il | P| : 
Tasks Problems | Properties | Build Console | 4 OCD Command Shell £3 % > ial 
[Connected to PPC7SOFX] > o eZ w & w po) > | 
TBREAK! = [MWSGIZUUU] SOItware Hreakpoint; PU = UXUUUL: © 
>BKM> | 
“an one 
x! 
P-RUN> ox0001CF80 
>BKM>go Ox00015F8E 
>RUN>ha Ox00014FE0 
>BKM>go Ox008ES6DC 
>RUN> oxo00000000 
>BEM> Ox3FFOOEA7 
>RUN> : Ox24F27DB6 
= 0x00000011 
, 0x00000000 
'BREAK! -— [msg11001] Internal hardware breakpoint; PC Ox00BC614E 
>BKM> __] Ox00000000 
>BKM> Mi 0x0001D25C 
Ka > 


10.5.7 Disconnecting and Terminating Processes 


Disconnecting from a process or core detaches the debugger, but leaves the process 
or core in its current state. 


Terminating a process actually kills the process on the target. 
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NOTE: If the selected target supports terminating individual threads, you can 


select a thread and terminate only that thread. 
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11.5 Flash Add/Remove Files Tab 91 
11.6 Flash Programming Tab 93 

11.7 Flash Memory/Diagnostics Tab 95 


11.1 Introduction 


In order to erase and program target flash memory, you must first set up your 
target registers properly, as described in 7. Board Initialization. 


The Flash Programmer view provides the ability to flash images into flash chips 
present on your target. 


To program flash correctly you need to know the physical characteristics of your 
flash bank. For instance, your target may have one flash device connected to a 
64-bit bus. Or it may have a bank of several flash devices, for example two flash 
devices, each wired at 16 bits, connected along a 32-bit bus. If you are using a Wind 
River-supported target, this information can be found in the file 
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installDir/vxworks-6.x/target/config/yourTarget/target.nr 
or 
installDirlvxworks-6.x/target/config/yourTarget/target.ref 


If you are not using a Wind River-supported target, consult your target’s 
documentation. The design primitives of your target board should be included in 
its board specification and schematics. 


11.2 Testing Flash Workspace 


The flash programming algorithm needs to run on the target. This requires a RAM 
workspace, to which the algorithm will download, and breakpoints, which are 
used to stop an erase and program operation at completion. 


Reading and Writing Memory 


Once you have established communications with the target, use the following 
procedure to make sure you can write to and read from the target. In this example 
we assume that the RAM workspace is 0x00F00200. 


NOTE: A RAM workspace address of 0x00F00200 is not appropriate for all targets. 
For Wind River-supported targets, you can find the necessary RAM workspace in 
your target’s target.ref file, located in 
installDir/vxworks-6.x/target/config/yourTarget/target.ref. 


Wherever the RAM workspace is located on your target, you must make sure that 
memory is writable there. 


At the >BKM> prompt, enter dm 00F00200 and press ENTER. Doing so displays the 
memory on your target at address 0. 


Next, enter sm 00F00200 1234 and press ENTER to set the memory at address 0 to 
the value 1234. Enter dm 00F00200 to display the memory at that address again. 


If you are communicating properly with your target, output is similar to that 
shown below: 
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>BKM>dm 00£00200 
OOF00200: FF7C EFFE FEFF E3FE 0D01 OFBE FOFD BFB6 . | i Bares es Bi hingeat 
>BKM>sm 00£00200 1234 
>BKM>dm 00£00200 
OOF00200: 1234 EFFE FEFF E3FE 0D01 OFBE FOFD BFB6 .4............. 
>BKM> 


Occasionally, you may have difficulty programming flash memory on your target 
if software breakpoints are not being hit properly. Test this functionality before you 
continue. 


To use the test, enter the following commands at the >BKM> prompt in the OCD 
Command Shell: 


>BKM>df e 0 


>BKM>di 0 6 


$00000000 : 0x60000000 :ppc nop 
$00000004 : 0x60000000 :ppc nop 
$00000008 : 0x60000000 :ppc nop 
$0000000C : 0x60000000 :ppc nop 
$00000010 : Ox7COOO04AC :ppc sync 
$00000014 : OxX4BFFFFFO :ppc b 0x4 
>BKM>go 0 
>RUN>dr pe 
PC = 00000004 
>RUN>dr pe 
PC = 00000010 
>RUN>sb 8 
>RUN> 
!BREAK! - [msg12000] Software breakpoint; PC = 0x00000008 [EVENT Taken] 
>BKM> 
>BKM>rb 
>BKM> 


11.3 Getting Started 


Once you have connected to Wind River Workbench, as described in your 
emulator’s Hardware Reference, and configured your target registers, as described 
in 7. Board Initialization, you are ready to begin programming flash. 


1. Inthe toolbar, click on Window, then select Show View > Flash Programmer. 


The Flash Programmer view appears. 
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Figure 11-1 Flash Programmer View 


Tasks Problems Properties Build Console OCD Command Shell (Nsreniste-iila tes OCD Statistical...” 


Programming | Add/Remove Files | Configuration | Memory/Diagnostics | 


Flash Settings Flash Programming 


Flash Driver: 2 = Fast Program | Batch Program 


Flash Bank: 


(_]Send "IN" before each operation 


(_JEnable pre-flash 


Workspace: 


Erase Sectors ——— 
[_]Enable post-flash 


Erase from: 


Erase to: 


Current Timeouts (in seconds) 


vv 
vv 


Erase: 


Progress 


— 


Messages 


The Flash Programmer view has four tabs: Configuration, Add/Remove Files, 
Programming, and Memory/Diagnostics. Use these tabs to configure your flash 
address and RAM workspace, choose files for download, execute erase and 
program operations, and check the results of your operations. 


11.4 Flash Configuration Tab 


Use the Configuration tab to configure the base address and workspace address 
for flash memory. You can also select which sectors of flash memory to erase and 
program, and enter the physical description of your flash devices. 
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Figure 11-2. Configuration Tab 


Programming | Add/Remove Files Configuration | Memory/Diagnostics 


Device Selection Configuration 
Current: Flash Bank Addresses 
=e —— = = SSS SS + 5 hi L 
=) AMD a [_] Override valid address checking 
H- 29LVO04T Base: Oxe0000000 Last: | 
(4) 29LVO04B a 
#) 29LVOO8BT - RAM Workspace 
# 29LVO08BB | Start: | oxoofo0z00 End: | 
(4) 29F010 ap ES 
iH 29F040 ca 
=) 29F080/81 Sectors 
f=} 1024x 8 
1 Device # Sector a 
2 Devices in} Oxe0000000 _— | 
AIevicns 1 Oxe0040000 
: |? fyennannnn =} 
8 Devices 
 29F016/17 Select all Clear all 
D_ POENI?7/22 Mi 


11.4.1 Selecting a Flash Driver 


In the Device Selection field, browse to a description of your flash bank. 
Figure 11-2 shows an example of a flash bank consisting of four 8-bit AMD 29F0808 
devices. 


NOTE: For AMD flash devices, “F” and “LV” devices are interchangeable in 
Workbench. 


11.4.2 Configuring Flash Memory Bounds 


In the Configuration field, enter the Base value for your flash bank address. In 
Figure 11-2 the address used is 0xe0000000. The Last field will populate 
automatically. 


NOTE: Workbench erases flash memory sector by sector. That means that no matter 
where the address you enter in the Base field is located within the flash sector, 
Workbench will still erase the entire sector. 


Workbench also allows greater user control by allowing manual configuration of 
the flash memory bounds. 
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For example, you may want to set the flash memory bounds manually to avoid 
erasing the target’s reset configuration word. 


You can manually configure the flash memory bounds by checking the Override 
Valid Address Checking checkbox. When this box is checked, Workbench will 
allow you to enter any addresses in the Base and Last fields. 


NOTE: If the values you enter result in a memory address range that is outside 
your target board’s flash programming area, erase and program operations will 
not perform correctly. 


11.4.3 Configuring RAM Workspace 


The flash programming algorithm needs to run on the target. This requires a RAM 
workspace, to which the algorithm will download. 


In the RAM Workspace field, enter the Start value for the area of flash memory 
you wish to erase and program. In the Size field enter the desired size of the 
workspace in bytes. In Figure 11-2 the starting address used is 0x00F00200 and the 
workspace size is 3992. The End field populates automatically. 


NOTE: A RAM workspace address of 0x00F00200 is not appropriate for all targets. 
For Wind River-supported targets, you can find the necessary RAM workspace in 
your processor’s target.ref file, located in 
installDirlvxworks-6.x/target/config/yourTarget/target.ref, or target.ref.linux file, 
located at http://www.windriver.com/support. 


11.4.4 Selecting Flash Sectors for Erasure 


The Sectors field automatically populates with the starting addresses of sectors of 
flash memory. Click on a sector to select it. You can select all sectors by clicking the 
Select All button. The Clear All button will deselect all sectors. 


Before you erase all sectors, make sure you know what resides in the flash. For 
example, PowerPC 82xx processors read their reset configuration word from 
FE000000 out of the flash device, so for 82xx processors, erasing the entire device 
may cause problems with resetting the board. 
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11.5 Flash Add/Remove Files Tab 


Use the Add/Remove Files tab to select files for downloading to flash memory. 


Figure 11-3 Add/Remove Files Tab 


Programming | Add/Remove Files | Configuration | Memory/Diagnostics 


Status File Path Start Ad... End Add... Enabled 


C:\workbench2.4\standalone-1.0\samples\ball_sa\... Ox00000,,. Ox00015.., “a Add File 
Convert file 


11.5.1 Adding Files 
To add a .bin file, click on the Add File button. This will open the Choose File for 
Flash Download dialog. Use the dialog to navigate to the directory where your 
-bin file is located. Select the file you want and click Open. The file will appear in 
the File Path field. 

11.5.2 Removing Files 


To remove a file from the list, highlight it and then click the Remove File button. 


11.5.3 Converting .hex Files To .bin Format 
Clicking on the Convert File button will open the Choose File for Flash 


Download explorer window and automatically set the Files of Type: field to .hex. 
Workbench will automatically look for a folder labeled firmware. If your .hex files 
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are stored in another folder, use the explorer to navigate to it. Select the file you 
want and click Open. The file will be converted to .bin format and appear in the 
File Path field. 


11.5.4 Setting The Download Offset Of A File 


In some cases, before you program the file into flash, you may need to set a 
memory offset bias to divert the data to other areas of the flash bank. 


Each file is built with a start address. This start address may or may not be the 
address where you want the image to reside on the board. If you take the start 
address of the image away from the address where you want the image to reside 
on the board, then you end up with the proper bias address. 


For example, if the image was built with a start address of 0x00 and you wanted 
the image to reside at the reset vector 0OxFFF00100, then the offset bias would be 
FFFO00100. 


You can use the Add/Remove Files tab to edit the starting address of a .bin file to 
offset the file into flash. Click on the value under the Start Address heading to 
highlight it. Edit the value as needed. 


11.5.5 Enabling A File For Download 


Enable a file by clicking on the checkbox under the Enabled heading. If you get an 
error message such as the one shown inFigure 11-4, you must either change the 
start address of your file or use the Configuration tab to change your flash address 
range. 


Figure 11-4 Enabling File Error Message 


ay 3 Res 


Cannot enable For download 
Part of this file Falls outside of your flash address range 
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11.6 Flash Programming Tab 


Use the Programming tab to execute your operations in flash. 


Figure 11-5 Programming Tab 


Tasks Problems Properties Build Console OCD Command Shell (oS Pentsees unit atad OCD Statistical C... ” 


} Programming | Add/Remove Files | Configuration | Memory/Diagnostics 


Flash Settings Flash Programming 


—___. 
Flash Driver: | Fast Program | Batch Program 


Flash Bank: 
Send "IN" before each operation 


Enable pre-flash 


Workspace: [ 


Erase Sectors 


Erase From: | | bs | Oo area poi [Browse | — 7 


Erase to: [ ; | 


[Erase | Program refProar| | verify J [Abort J 


Current Timeouts (in seconds) 


Program: a 
Erase: Edit 


Progress Messages 


[ 


11.6.1 Fast And Batch Program Tabs 


There are two tabs in the Flash Programming area of the Programming tab: Fast 
Program and Batch Program. 


In the Fast Program tab you can select and execute individual operations, such as 
erasing or programming a sector of flash memory. 
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Figure 11-6 Fast Program Tab 
Fast Program | Batch Program 


[_]Send "IN" before each operation 


[_]Enable pre-flash 
[_]Enable post-flash 


In the Batch Program tab, you can set all your operations to execute as a batch. 
Check the operations you want to perform and click Execute. 


Figure 11-7 Batch Program Tab 


| Fast Program: Batch Program 


[initialize 

[_] Enable pre-flash 
im Erase 

[| Program 

[| verify 


[_] Enable post-flash 


11.6.2 Erasing Flash 


Clicking the Erase button will erase the contents of the flash memory sectors you 
selected in the Configuration tab. 
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You can also check the Erase box in the Batch Program tab to perform the erase as 
part of a batch execution. 


11.6.3 Programming Flash 
Clicking the Program button will program the flash memory sectors you selected 
in the Configuration tab with the files you selected in the Add/Remove Files tab. 


You can also check the Program box in the Batch Program tab to perform the 
program as part of a batch execution. 


11.6.4 Verifying Flash Contents 


Clicking the Verify button will execute a byte-by-byte comparison between the file 
you just downloaded and the file already in memory. If there is a discrepancy, it 
will break at that address and deliver an error message. 


You can also check the Verify box in the Batch Program tab to perform the memory 
comparison as part of a batch execution. 


11.6.5 Setting Timeouts 
To set an program or erase timeout, click the Edit button to highlight the Erase or 


Program field in the Current Timeouts area. Enter a timeout value in seconds. If 
you enter an invalid number, the timeout will reset to the default setting. 


11.7 Flash Memory/Diagnostics Tab 


Use the Memory/Diagnostics tab to view the contents of flash memory and to run 
diagnostic tests to verify your ability to write and erase flash. 


You must set up the Configuration tab before using the Memory/Diagnostics tab. 
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Figure 11-8 Memory/Diagnostics Tab 


Programming | Add/Remove Files | Configuration Memory/Diaanostics | 


View address: J oxfFrooooa 


| Program | Erase | Abort | 


FFFOOO10 
FFFOOO20 
FFFOOO30 
FFFOOO40 
FFFOOOSO 
FFFOOO60 
FFFOOO70 
FFFOOOS8O 
FFFOOOSO 
FFFOOOAO0 
FFFOOOBO 
FFFOOOCcO 
FFFOOODO 
FFFOOOEO 
FFFOOOFO 


jaddress [0 [1 [2 [3 [4 [5 [6 [7 [@ Jo [a |e [c Jo [e |r [ascrz C 


[July 20, 2¢ 
0123456789ak 
ghijklmnopqr 
wxyz!BHSS* G+ 


[ Messages 


— eT ao —— 


11.7.1 Viewing Memory 


Enter the address you wish to view in the View Address field. The area below 
displays the bit-level detail. To change the view, edit the address in the View 
Address field and click Refresh. You can also use the scrollbar on the right to scroll 
up and down from the starting address to the end address. 


11.7.2 Running Diagnostic Tests 


To test your ability to write to flash memory, click the Start Program Diagnostic 


button. This writes a bit pattern to flash. 


You may see a Target Exception message. This requires no action. 


If the write operation is successful, you should see the pattern *WRS_FLASH* 
repeated under the ASCII heading in the Memory/Diagnostics tab, as shown in 


Figure 11-9. 
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Figure 11-9 Successful Program Diagnostic 


Programming | Add/Remove Files | Configuration Memory/Diagnostics | 


View address: J Oxfffooooo Refresh | Program | Erase | 


SF 46 4C 41 53 48 2A SF 24 S57? S52 53 SF 46 4C 41 _FLASH*_ *WRS_FLA 
53 48 2h SF 2A S57 52 53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
24 57 52 53 SF 46 4C 41 53 48 2A SF 2A S57? S2 53 *WRS_FLASH*_*WRS 
SF 46 4C 41 53 48 2A SF 24 S? 52 53 SF 46 4C 41 _FLASH*_ *URS_FLA 
53 48 2A SF 2A S57? S52 53 SF 46 4C 41 53 48 ZA SF SH*_*WRS_FLASH*_ 
2a S57 S52 53 SF 46 4C 41 53 48 2A SF 2A S7? SZ 53 *WRS_FLASH*_*WRS 
SF 46 4C 41 53 48 2A SF 24 S57? S52 53 SF 46 4C 41 _FLASH*_*WURS_FLA 
53 48 2A SF 2A 57 52 53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
2A S57? S52 53 SF 46 4C 41 53 48 2A SF 2A S7? S2 53 *WRS_FLASH*_*WRS 
SF 46 4C 41 53 48 2A SF 24 S7? S52 53 SF 46 4C 41 _FLASH*_ *URS_FLA 
53 48 2A SF 28 S57? 52 53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
2a S57 52 53 SF 46 4C 41 53 48 2A SF 2A S57 S2 53 *WRS_FLASH*_*WRS 
SF 46 4C 41 53 48 2A SF 2A S7? S2 53 SF 46 4C 41 _FLASH*_ *WURS_FLA 
53 48 2A SF 248 S57 52 53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
24 S57? S52 53 SF 46 4C 41 53 48 2A SF 2A S7? S2 53 *WRS_FLASH*_*WRS 


Messages 


OT 


If the write operation is unsuccessful, the diagnostic will never complete. You will 
need to click the Abort Diagnostic button to stop the write operation. Check to 
make sure that you have the right flash device selected in the Device Selection 
area in the Configuration tab, and that you are using the correct base address. 


To test your ability to erase flash memory, click the Start Erase Diagnostic button. 
This will erase the selected flash sectors. 


You may see a Target Exception message. This requires no action. 


If the erase operation is successful, the selected sectors will be erased and the space 
under the ASCII heading in the Memory/Diagnostics view will be empty. 


If the erase operation is unsuccessful, the diagnostic will never complete. You will 
need to click the Abort Diagnostic button to stop the erase operation. Check to 
make sure that you have the right flash device selected in the Device Selection 
area in the Configuration tab, and that you are using the correct base address. 
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12.1 Overview 


The procedure described in 10. Debugging in RAM uses software breakpoints. 
Software breakpoints work by replacing the destination instruction with an 
interrupt; therefore it is impossible to debug code in ROM using software 
breakpoints. 


To debug code in ROM you must use hardware breakpoints, which work by setting 
a break condition and comparing the condition with the execution stream. This 
chapter describes using Workbench to debug code in ROM with hardware 
breakpoints. 
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12.2 Getting Started 


To debug code in ROM, you must have an active target connection. 


To create an active target connection, follow the steps described in 5. OCD 
Connections. 


NOTE: You cannot use the Instruction Set Simulator to simulate debugging in 
ROM, because you must have an actual target in order to set hardware 
breakpoints. 


You do not need to have an active project to debug code in ROM. 


12.3 Debugging in ROM 


Use the Debug view to monitor, control, and manipulate the processes and tasks 
that you are actively debugging. The Debug view shows only the processes that 
are currently under debugger control. 


1. Inthe Target Manager view, right-click on your target name and select Attach 
to Core. 


The Disassembly view opens, with the Program Counter set to the start of the 
reset vector. 
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WRProbe_PPC7S0FX 


System Context 

> f£f00100: i Ese 
fff00104: 
ff£f00108: OxFFFOO138 
ff£f0010c: Ox1B, OxF, OxFFFO7184 
fff00110: r9,r19,0x6768 
f£f00114: £0;21,0x3139 
ff£f00118: ri,r20,0x2D32 
*fffoolic: r1,r16,0x3220 
#£f£00120: r9,r27,0x26,0xD 
ff£f00124: r2,r18,0x6976 
ff£f00128: ri8,r11,0x2053 
ff£fO012e: Ox7973 7465 
f££00130: r19,r11,0x2C20 
f£f00134: Ox16E632C 
f£f00138: ELL Fs 
fff0013ec: r4,r4,r4 
ff£f00140: r0,r4 
f£f00144: 
fff00148: r4 
ff£fO0014e: 
fff00150: r0;.20;7r0 
fff00154: sprgQ0,r0 
fff00158: sprgi,rO 
fff0015c: sprg2,r0 
fff00160: sprg3,r0 
f£f00164: r4,r4,r4 
fffto00168: 0,r4 


2. Inthe Target Manager view, select OCD Reset and Download. 
3. Select the Reset tab. 
4. Set the reset type to INN -- Reset. 
This will initialize the target, but leave the target registers as close to reset 


value as possible. 


NOTE: Because the target registers are not set, the target software watchdog 
timers are still active. This can cause some targets, such as PowerPC82xx 
targets, to drop out of background mode. 


Leave the Play register file box unchecked. 
Select the Download tab. 
Click Add Files... 


90: co -Oy “go 


In the browser window that appears, navigate to the boot ROM file for your 
target. 
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Tasks Problems Properties Error Log Terminal OCD Command Shell OCD Console * CF Options ” 


~ Reset and Download 


Since this example uses a Wind River PPMC750FX target, the boot ROM file is 
located in 
installDir/vxworks-6.x/target/config/wrPpmc750fx/bootrom_uncmp. 


Click Open. 
You are returned to the Download tab. 
Uncheck the Download checkbox. 


Make sure the Load Symbols checkbox is selected and the Verify field is set to 
None. 


Select the Instruction Pointer tab. 

Uncheck the Set instruction pointer after download checkbox. 
Select the Run Options tab. 

Make sure the Do not run checkbox is selected. 

Click Debug. 


The OCD Console view opens to show the results. 


a 


Testing Communications to Hardware Interface.... Passed 
Driving HRESET to be High Passed 
Driving HRESET to be Low Passed 
Waiting HRESET Low Acknowledge. coat Passed 
Attempting JTAG communication... ion Passed 
Waiting for HReset to be released.. ! Passed 
Testing for target STOP State Passed 
Comparing target CPU with CF setting te Passed 
Waiting For HRESET High Acknowledge. or Passed 
Testing JTAG Communication, Passed 
Testing JTAG Communication. ‘i Passed 
Getting value of cF mmu option .. Passed 
Attempting to restore CPU context. Passed 
Loading symbols... 

C:\WindRiver\yxworks-6, 3\target\configiwrPpmec750Fx\bootrom_uncmp Specified not to Download 
Specified not to Run 

* Reset and Download Completed * 
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12.3.1 Stepping Through Boot Code 


In this example, the first line of the reset vector is a Load Immediate command: 
f££00100 li r2, 13 

In the Debug view, click the Step Into button. 

The Program Counter moves to the No-Operation command on the next line: 
£££00104 nop 


In the Debug view, the System Context changes to Stopped -- Step End, and the 
view updates to show the new location of the Program Counter. 


® Debug X 


o> of 22 Rk Bz 
=) &%} WRProbe_PPC?S0Fx [Attach to Target] 
El PPC750FX (System Mode) 
& a System Context (Stopped - Step End) 


=" ane 


If you have data views, such as the Watch view, Memory view, or Registers view 
open, you can see them update as you step through code. 


In the Debug view, click Step Into again. 

The Program Counter moves to the Branch and Link instruction on the next line: 
£££00108 bl OxFFF00138 

In the Debug view, click Step Into one more time. 


The branch instruction executes and the Program Counter jumps to address 
FFF00138. The Debug view updates to show the Program Counter at address 
FFFO00138. 
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® Debug * 


Oe bf 28 V3 = 
S &% WRProbe_PPC?7S0F% [Attach to Target] 
=) PPC7SOFX (System Mode) 
=) co System Context (Stopped - Step End) 


ig OxfFFOO138 
Oo 


= oOxfffoo108 


12.3.2 Setting Hardware Breakpoints 


Breakpoints allow you to stop a running program at particular places in the code 
or when specific conditions exist. Use the Breakpoints view to keep track of your 
breakpoints and their conditions. 


To debug in ROM you must use hardware breakpoints. The availability of 
hardware breakpoints varies by architecture. You can only set as many hardware 
breakpoints as there are debug registers available on your target. 


Once a hardware breakpoint is trapped, the debugger will behave in the same way 
as for a standard breakpoint and stop for user interaction. 


For a full description of hardware breakpoints in Workbench, see B. Internal 
Breakpoint Capabilities. 


In the Disassembly view, right-click in the left ruler (the gutter) to the left of the 
Exclusive Or instruction at address FFF00150: 


f££00150 xor r0,r0,r0 


From the context menu that appears, select Add Hardware Breakpoint. 


The breakpoint appears in the Disassembly view and is displayed in the 
Breakpoints view. 
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12 Debugging in ROM 
12.3 Debugging in ROM 


*s Breakpoints 


ex Ke 


3S OxfffO01S0 (Hardware,Restricted Scope} 


In the Debug view, click the Resume button. 
The code runs until it hits the hardware breakpoint at address FFF0O0150. 
In the Debug view, the System Context changes to Stopped --Breakpoint Hit. 


® Debug X 


i Se ee 
a cc] WRProbe_PPC750Fx [Attach to Target] 
| ee PPC?SOFX (System Mode) 
= a System Context (Stopped - Breakpoint Hit) 
8 OxfFFOO150 


=" oxfffoo108 


The following message appears in the OCD Command Shell: 


>RUN> 


!BREAK! - [msg11001] Internal hardware breakpoint; PC = Oxfff00150 [EVENT 
Taken] 
>BKM> 


To remove the hardware breakpoint, double-click on the breakpoint icon in the 
Disassembly view gutter, or right-click on the breakpoint in the Breakpoints view 
and select Remove. 
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Pins Mapped to Common 
Signals 


A.1 Introduction 107 

A.2 PowerPC Processors --JTAG 108 
A.3 MIPS Processors --JTAG 109 
A.4 ARM Processors --JTAG 110 
A.5 ColdFire Processors --JTAG 111 
A.6 BDM Processors 112 


A.1 Introduction 


This appendix describes mapped pins to common signals for Wind 
River-supported processor families. 


For all families described in this appendix, “n” is set as an ACTIVE LOW. 
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A.2 PowerPC Processors -- JTAG 


Table A-1 


PowerPC -- JTAG 


Pin 

Number Function Description 

1 TDO Test Data Out 

2 nQACK Quiescent Acknowledge 
3 TDI Test Data In 

4 nTRST Test Reset (reset JTAG clock) 
5 nQREQ Quiescent Request 

6 JTAG_VIO JTAG Voltage Output 

7 TCK Test Clock 

8 CHKSTPIN Checkstop Input 

9 TMS Test Mode Select 

10 PIN10 Hardwired 

11 nSRESET Software Reset 

12 GND Ground 

13 nHRESET Hardware Reset 

14 NC Not Connected 

15 CHKSTPO Checkstop Output 

16 GND Ground 
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A.3 MIPS Processors -- JTAG 


Table A-2 


MIPS -- JTAG 


Pin 
Number Function 


A Pins Mapped to Common Signals 
A.3 MIPS Processors -- JTAG 


Description 


1 nTRST Test Reset (reset JTAG clock) 
2 GND Ground 

3 TDI Test Data In 

4 GND Ground 

5 TDO Test Data Out 

6 GND Ground 

7 TMS Test Mode Select 

8 GND Ground 

9 TCK Test Clock 

10 GND Ground 

11 nRESET Processor Reset 

12 NC Not Connected 

13 DINT Debugger Interrupt 
14 JTAG_VIO JTAG Voltage Output 
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A.4_ ARM Processors -- JTAG 


Table A-3. ARM -- JTAG 


Pin 

Number Function Description 

1 JTAG_VIO JTAG Voltage Output 
2 NC Not Connected 

3 nTRST Test Reset (reset JTAG clock) 
4 GND Ground 

5 TDI Test Data In 

6 GND Ground 

7 TMS Test Mode Select 

8 GND Ground 

9 TCK Test Clock 

10 GND Ground 

11 RTCK Return Test Clock 

12 GND Ground 

13 TDO Test Data Out 

14 GND Ground 

15 nRESET Processor Reset 

16 GND Ground 

17 DBGRQ Debug Request 

18 GND Ground 

19 DBGACK Debug Acknowledge 
20 GND Ground 
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A Pins Mapped to Common Signals 
A.5 ColdFire Processors -- JTAG 


A.5 ColdFire Processors -- JTAG 


Table A-4 ColdFire -- JTAG 


naeeee Function Description 

a NC Not Connected 

2 nBKPT Hardware Breakpoint 

3 GND Ground 

4 DSCLK Development Serial Clock 
5 GND Ground 

6 NC Not Connected 

7 nRESET Reset 

8 DSDI Debug Serial Data Input 

9 VCC_IO R1-3 Board Voltage via jumpers 
10 DSDO Debug Serial Data Output 
11 GND Ground 

12 PST3 Trace pin 

13 PST2 Trace pin 

14 PST1 Trace pin 

15 PSTO Trace pin 

16 DDATA3 Trace pin 

17 DDATA2 Trace pin 

18 DDATA1 Trace pin 

19 DDATAO Trace pin 

20 GND Ground 

21 NC Not Connected 

22 NC Not Connected 
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Table A-4 ColdFire -- JTAG 


ees Function Description 

23 GND Ground 

24 PSTCLK Trace clock 

25 VCC_CPU R1-1 CPU Voltage via jumpers 

26 nTEA Transfer EEPROM Acknowledge 


A.6 BDM Processors 


Table A-5> BDM Processors 


Pin 

Number Function Description 

1 VFLSO Visible Flash Status bit 0 
2 nSRESET Software Reset 

3 GND Ground 

4 DSCK Debug Serial Clock 

5 GND Ground 

6 VFLS1 Visible Flash Status bit 1 
7 nHRESET Hardware Reset 

8 DSDI Debug Serial Data Input 
9 BDM_VIO Voltage Input/Output 
10 DSDO Debug Serial Data Output 
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Internal Breakpoint 
Capabilities 


Emulators use breakpoints to implement single stepping, since the embedded 
processor’s single step mode, if it has one, is not useful for stepping through C 
code. 


Software breakpoints work by replacing the destination instruction by a software 
interrupt. Therefore, it is impossible to debug code in ROM using software 
breakpoints. 


Hardware breakpoints work by setting a break condition and comparing it against 
the execution stream. You can use hardware breakpoints to debug code in RAM, 
ROM, flash memory, or even unused address spaces. 


Complex breakpoints involve conditions. An example might be, “Break if the 
program writes value to variable if and only if function_name was called first.” A 
software-only debugger setting a complex breakpoint must interpret the program 
while watching for the trigger condition, which slows performance. Emulators 
implement complex breakpoints in hardware, so there is no performance penalty. 


In Wind River Workbench, you can use the Breakpoints view to keep track of all 
breakpoints, along with any conditions. 


You can create breakpoints in different ways: by double-clicking or right-clicking 
in the Editor’s left overview ruler (also known as the gutter), by opening the 
various breakpoint dialogs from the pull-down menu in the Breakpoints view 
itself, or by selecting one of the breakpoint options from the Run menu. 


Wind River Workbench supports three kinds of breakpoints: line breakpoints, 
expression breakpoints, and hardware breakpoints. 
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Line Breakpoints 


Set a line breakpoint to stop your program at a particular line of source code. 


To set a line breakpoint with an unrestricted scope (that will be hit by any process 
or task running on your target), double-click in the left gutter next to the line on 
which you want to set the breakpoint. A solid dot appears in the gutter, and the 
Breakpoints view displays the file and the line number of the breakpoint. You can 
also right-click in the gutter and select Add Global Line Breakpoint. 


To set a line breakpoint that is restricted to just one task or process, right-click in 
the Editor gutter and select Add Breakpoint for selected thread. If the selected 
thread has a color in the Debug view, a dot with the same color will appear in the 
Editor gutter, with the number of the thread inscribed inside it. 


Either of these actions opens the Line Breakpoint dialog, where you can create and 
adjust the properties of the breakpoint. 


Expression Breakpoints 


Set an expression breakpoint using any C expression that will evaluate to a 
memory address. This could be a function name, a function name plus a constant, 
a global variable, a line of assembly code, or just a memory address. Expression 
breakpoints appear in the Editor’s gutter only when you are connected to a task. 


Breakpoint conditions are evaluated after a breakpoint is triggered, in the context 
of the stopped task or process. Functions in the condition string are evaluated as 
addresses and are not executed. Other restrictions are similar to the C/C++ 
restrictions for calculating the address of a breakpoint using the Expression 
Breakpoint dialog. 


Select Add Expression Breakpoint from the pull-down menu in the Breakpoints 
view to open the Expression Breakpoint dialog, where you can create and adjust 
the properties for the breakpoint. 


Hardware Breakpoints 


Some processors provide specialized registers called debug registers that can be 
used to specify an area of memory to be monitored. For instance, [A-32 processors 
have four debug address registers, which can be used to set data breakpoints or 
control breakpoints. 
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B Internal Breakpoint Capabilities 


Hardware breakpoints are useful if you want to stop a process when a specific 
variable is written or read. For example, with hardware data breakpoints, a 
hardware trap is generated when a write or read occurs in a monitored area of 
memory. Hardware breakpoints are fast, but their availability is 
machine-dependent. On most CPUs that do support them, only four debug 
registers are provided, so you can only watch a maximum of four memory 
locations in this way. 


There are two types of hardware breakpoints: 
* A hardware data breakpoint occurs when a specific variable is read or written. 


« A hardware instruction breakpoint or code breakpoint occurs when a specific 
instruction is read for execution. 


Once a hardware breakpoint is trapped—either an instruction breakpoint or a data 
breakpoint—the debugger will behave in the same way as for a standard 
breakpoint and stop for user interaction. 


Adding Hardware Instruction Breakpoints 
There two ways to add a new hardware instruction breakpoint: 


In the gutter on the left of the source file, right-click and select Add Hardware 
Code Breakpoint. Alternately, double-click in the gutter to add a standard 
breakpoint and then, in the Breakpoints view, right-click the breakpoint you just 
added and select Properties. In the last pane (Hardware) of the Properties dialog, 
select Enable Hardware Breakpoint. 


Adding Hardware Data Breakpoints 


Set a hardware data breakpoint when: 


* The debugger should break when an event (such as a read or write of a specific 
memory address) or a situation (such as data at one address matching data at 
another address) occurs. 


« Threads are interfering with each other, or memory is being accessed 
improperly, or whenever the sequence or timing of runtime events is critical 
(hardware breakpoints are faster than software breakpoints). 


Select Add Data Breakpoint from the pull-down menu in the Breakpoints to open 
the Hardware Data Breakpoint dialog, where you can create and adjust the 
properties for the breakpoint. 
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Converting Line or Expression Breakpoints Into Hardware Code Breakpoints 


To cause the debugger to request that a line or expression breakpoint be a 
hardware code breakpoint, select the Hardware check box on the Hardware tab of 
the Line Breakpoint or Expression Breakpoint dialog. 


This request does not guarantee that the hardware code breakpoint will be planted; 
that depends on whether the target supports hardware breakpoints, and if so, 
whether or not the total number supported by the target have already been 
planted. If the target does not support hardware code breakpoints, an error 
message will appear when the debugger tries to plant the breakpoint. 


NOTE: Workbench will set only the number of code breakpoints, with the specific 
capabilities, supported by your hardware. 


NOTE: If you create a breakpoint on a line that does not have any corresponding 
code, the debugger will plant the breakpoint on the next line that does have code. 
The breakpoint will appear on the new line in the Editor gutter. In the Breakpoints 
view, the original line number will appear, with the new line number in square 
brackets [] after it. 


Importing Breakpoints 


To import breakpoint properties from a file: 


1. Select File > Import > Import Breakpoints, then click Next. The Import 
Breakpoints dialog appears. 


2. Select the breakpoint file you want to import, then click Next. The Select 
Breakpoints dialog appears. 


3. Select one or more breakpoints to import, then click Finish. The breakpoint 
information will appear in the Breakpoints view, and the next time the context 
for that breakpoint is active in the Debug view, the breakpoint will be planted. 


Exporting Breakpoints 


To export breakpoint properties to a file: 


116 


B Internal Breakpoint Capabilities 


1. Select File > Export > Export Breakpoints, then click Next. The Export 
Breakpoints dialog appears. 


2. Select the breakpoint whose properties you want to export, and type ina file 
name for the exported file. Click Finish. 


Refreshing Breakpoints 


Right-click a breakpoint in the Breakpoints view and select Refresh Breakpoint to 
cause the breakpoint to be removed and reinserted on the target. This is useful if 
something has changed on the target (for example, you downloaded a new 
module) and the breakpoint is not automatically updated. 


To refresh all breakpoints in this way, select Refresh All Breakpoints from the 
pull-down menu in the Breakpoints view. 


Disabling Breakpoints 
To disable a breakpoint, clear its check box in the Breakpoints view. This retains all 
breakpoint properties, but ensures that it will not stop the running process. To 
re-enable the breakpoint, select the box again. 

Removing Breakpoints 


To remove a breakpoint: 


« Right-click on a breakpoint in the Editor gutter and select Remove 
Breakpoint. 


« Select a breakpoint in the Breakpoints view and select Remove. 
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Pin Terminations 


C.1 JTAG Pin Terminations 119 
C.2 EJTAG Pin Terminations 125 
C.3 BDM Pin Terminations 136 
C.4 Mictor Pin Terminations 141 


C.1 JTAG Pin Terminations 


C.1.1 16-Pin JTAG Connector 


The following processors use this pinout: 


» AMCC 40x 
» AMCC44x 


AMCC 40x and 44x can also use 38-pin Mictor connectors for run control. 
See C.4 Mictor Pin Terminations, p.141. 


= PowerPC5xxx 
= ~~ PowerPC6xx 
=  PowerPC7xx 
»  PowerPC74xx 
»  PowerPC82xx 


119 


Wind River 
Board Bring-Up Guide, 1.0 


=  PowerPC83xx 
= ~~ PowerPC85xx 


The connector type on your board should be as follows: 
"16 (2 by 8) 0.025" square posts 

» 0.10" between centers of adjacent posts 

» 0.23" height of each post 

A sample connector is Samtec part number TSW-108-07-S-D. 


Figure C-1 shows the pinouts for this connector. 


Figure C-1 16-pin JTAG Connector Pinouts 


TDO 1 2NC 
TDL 3 4 TRST 
(QREQ 5 6 EXPSENSE 
TK 7 8 NIC 
TMS 9 10 NIC 
SRESET 11 12 GND 
/HRESET 13 14 NC 
{CHKSTPO 15 16 GND 


The following table contains the Wind River-recommended pull-up/ pull-down 
resistor values that must be placed on the target. Signals not shown should not 
have pull-ups or pull-downs. 
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C.1 JTAG Pin Terminations 


Table C-1 16-pin Connector JTAG Terminations 


Signal Name Description 
TRST External 4.7K pull-up 
EXPSENSE External 1K pull-up 


NOTE: These are the termination values for the Wind River reference design. It is 
important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are working with. 


C.1.2 ARM 14-Pin JTAG Connector 


The connector type on your board should be as follows: 

» 14 (2 by 7) 0.025" square posts 

» 0.10" between centers of adjacent posts 

* 0.23" height of each post 

A sample connector is Samtec part number TSW-107-07-S-D 


The pin-outs of this connector are shown in Figure C-2. 
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Figure C-2. ARM 14-Pin JTAG Connector Pinouts 


(33V)SPU 1 GND 
nTRST 3 GND 
TMH 5 GND 
™sS 7 GND 
T 9g GND 
TDO 11 niCERST 

(3.3V) SPU 13 14 GND 


JTAG Terminations 


The following table contains the Wind River-recommended pull-up/pull-down 
resistor values that must be placed on the target. Signals not shown should not 
have pull-ups or pull-downs. 


Table C-2 
Signal Name Description 
TCK - Test Clock External 5K pull-down 
TMS - Test Mode External 5K pull-up on PCB 
TDI - Test Data In External 5K pull-up on PCB 
TDO - Test Data Out External 5K pull-up on PCB 
nTRST - Reset TAP Controller External 2K pull-up on PCB 
/nICERST (nPOR) External 2K pull-up on PCB 
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C Pin Terminations 
C.1 JTAG Pin Terminations 


NOTE: These are the termination values for the Wind River reference design. It is 
important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are using. 


C.1.3 ARM 20-Pin JTAG Connector 


The connector type on your board should be as follows: 

= 20 (2 by 10) 0.025" square posts 

« 0.10" between centers of adjacent posts 

» 0.23" height of each post 

A sample connector is Samtec part number TSM-110-01-S-DV. 


The pin-outs of this connector are shown in Figure C-3. 


Figure C-3 ARM 20-Pin JTAG Connector 


VYef 4 2 \VSLFPLY 
niRst 3 4 GND 
DI 5 6 GND 

MS 7 8 GND 
EK 9 10 GND 
RICK 11 12 GND 
DO 13 14 GND 
NERST 15 16 GND 
DEGR@ 17 18 GND 
DBGACK 19 20 GND 
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JTAG pull-ups and pull-downs are not provided for the 20-pin connector. Please 


refer to the specifications from the board manufacturer to determine the 
appropriate pull-ups and pull-downs for your board. 


C.1.4 ARMX (XScale) 20-Pin JTAG Connector 


The connector type on your board should be as follows: 

» 20 (2 by 10) 0.025" square posts 

« 0.10" between centers of adjacent posts 

» 0.23" height of each post 

A sample connector is Samtec part number TSM-110-01-T-DV. 


The pin-outs of this connector are shown in Figure C-4. 


Figure C-4 ARMX 20-Pin JTAG Pinout 


Vitef |3.5V) 1 2 Vsurrty [3.34 
nest 3 4 OND 
TD) 5 6 GND 
IVS 7 & GND 
TK 9 10 GND 
RICK 11 12 GND 
IDO 13 14 GND 
NHRESET 15 16 GND 
NO 17 @ GND 
yo 20 GND 
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C Pin Terminations 
C.2 EJTAG Pin Terminations 


JTAG Terminations 


The following table contains the Wind River-recommended pull-up/pull-down 
resistor values for this target. Signals not shown should not have pull-ups or 
pull-downs. 


Table C-3 ARMX (XScale) JTAG Terminations 


Signal Name Description 
/TRST External 4.7K pull-down 
/HRESET External 2.7K pull-up 


NOTE: These are the termination values for the Wind River reference design. It is 
important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are using. 


C.2 EJTAG Pin Terminations 


C.2.1 MIPS 14-Pin EJTAG Connector 


The standard MIPS 14 pin connector is as follows: 

» 14 (2 by 7) 0.025” square posts 

» 0.10” between the centers of adjacent posts 

» 0.23” height of each post 

A sample connector is Samtec part number TSW-107-07-S-D. 


The pinout of this connector is shown in Figure C-5. 


125 


Wind River 
Board Bring-Up Guide, 1.0 


Figure C-5 MIPS 14-Pin EJTAG Connector Pinout 


ETRST_N 1 2 GND 
ETDI 3 4 GND 
ETDO 5 6 GND 
ETMS 7 8 GND 
ETCK g 10 GND 

GRST_N 11 12 GND 

EDINT 13 14 VIO 


EJTAG Terminations 


Table C-4 contains the Wind River recommended pull-up/pull-down resistor 
values for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-4 MIPS 14-Pin EJTAG Terminations 


Signal Name Description 

ETCK External 1K pull-up 
ETM External 1K pull-up 
ETDI External 1K pull-up 
ETRST_N External 1K pull-down 
EDINT External 1K pull-up 
GRIST_N External 1K pull-up 


C.2.2 MIPS Philips 20-Pin EJTAG Connector 


Philips processors come with a 14- to 20-pin adapter that allows users to connect 
to their target. The Philips 20-pin connector is as follows: 
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C.2 EJTAG Pin Terminations 


= 20 (2x10) 0.016” square posts 

» 0.050” between centers of adjacent posts 

» 0.120” height of each post 

A sample connector is Samtec part number FISH-110-01-L-DV. 


The pin-out for the Philips 20-pin connector is shown in Figure C-6. 


Figure C-6 MIPS Philips 20-Pin EJTAG Connector Pinout 


Jiceg_itstn 1]/M@ Hj2 Gvp 

Jtog tddin 3|/ i Mla No 

Jiag Idojetag pc 5] M@ Mio GND 
Jieglims 7| @ M/s GND 
JIagick 9|  Hhaeann 
JTAG_RST 11| @ Wi l12 GNO 

Efag pcsqu) i3} ™@ Mi }i4 GND 
Eitag_pest{]] 15] @ M116 oxp 
Efiag_ pcst2] 17| M@ WM |18 GND 
Efac_acik 19) Mi Mi |20 GND 


NOTE: There are two adapters that ship with the tools, and one of them must be 


used to connect to the target. The only difference between the two adapters is that 
on one of them the pins are rotated 180 degrees. Use whichever adapter makes 
connecting to the target easier. Ensure that Pin 1 on the adapter is correctly aligned 
with Pin 1 on the target, and also with Pin 1 on your emulator. 


EJTAG Terminations 


Table C-5 shows the Wind River recommended pull-up / pull-down resistor values 
that must be placed on the target. Signals not shown should not have 
pull-ups/pull-downs. 
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Table C-5 MIPS Philips 20-Pin EJTAG Terminations 


Signal Name Description 
jtag_trst_n 10K pull-up resistor 
jtag_tdi 10K pull-up resistor 
jtag_tdo/ejtag_tpo 33 ohm series resistor 
jtag_tms 10K pull-up resistor 
jtag_tck 10K pull-up resistor 
jtag_rst 10K pull-up resistor 
ejtag_pcst[0] 33 ohm series resistor 
ejtag_pcst[1] 33 ohm series resistor 
ejtag_pcst[2] 33 ohm series resistor 


C.2.3 MIPS IDT 24-Pin EJTAG Connector 
IDT processors come with a 14 to 24 pin adapter that allows users to connect to 
their target. The IDT 24 pin connector is as follows: 
= 24 (2x12) 0.016” square posts 
» 0.050” between centers of adjacent posts 
» 0.120” height of each post 
A sample connector is Samtec part number FISH-112-01-L-DV. 


Pinouts for the IDT 24-pin connector are shown in Figure C-7. 
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C.2 EJTAG Pin Terminations 


Figure C-7 MIPS IDT 24-Pin ETAG Connector Pinout 


jag tstn 1|/ 8 2 GND 

jag td/dn 3/8 4 GND 
jtag tdo/ejtag tee 5 | MM | 6 GND 
jagtms 7|/ BB 8 GND 

jag tek 9| ME Me 10° GND 
jtag_rstn 11/ MH MH | 12° «GND 
gtag pest] 13) MM | 14 = GND 
etag_pestti] 175| MM Mi | 16 GND 
ejtag_pest(2] 17| J | 18 GND 
ejtag_delk 19) J Me | 20 GND 
ejtag_debugboct 21| MM | 22 GND 
vio 23| M ME | 24 Gno 


EJTAG Terminations 


Table C-6 shows the Wind River recommended pull-up / pull-down resistor values 
for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-6 MIPS IDT 24-Pin EJTAG Terminations 


Signal Name Description 
jtag_trst_n 10K pull-up resistor 
jtag_tdi 10K pull-up resistor 
jtag_tdo/ejtag_tpo 33 ohm series resistor 
jtag_tms 10K pull-up resistor 
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Table C-6 MIPS IDT 24-Pin EJTAG Terminations 


Signal Name Description 

jtag_tck 10K pull-up resistor 

jtag_rst_n 10K pull-up resistor 

ejtag_pcst[0] 33 ohm series resistor 

ejtag_pcst[1] 33 ohm series resistor 

ejtag_pcst[2] 33 ohm series resistor 

ejtag_dclk 33 ohm series resistor 

ejtag_debugboot 10K pull-down resistor 

VIO Must be connected to the VCC I/O supply 


C.2.4 MIPS Broadcom 10-Pin EJTAG Connector 


Some Broadcom targets use the standard MIPS 14-pin connector, and some use this 
10-pin connector. Make sure you use the pinout that matches what is on your 
target. 


Broadcom processors come with a 14 to 10 pin adapter that allows users to connect 
to their target. The Broadcom 10 pin connector is as follows: 


= 10 (2x5) 0.025” square posts 

» 0.10” between centers of adjacent posts 

» 0.23” height of each post 

A sample connector is Samtec part number SSQ-105-02-T-D. 


The pin-out for the Broadcom 10-pin connector is shown in Figure C-8. 
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C.2 EJTAG Pin Terminations 


Figure C-8 MIPS Broadcom 10-Pin Connector Pinout 


TRST 1 2 GND 
TDI 3 4 GND 
IDO 6 6 GND 
IMS 7 8 GND 
TCK 9 10 GND 


EJTAG Terminations 


‘Table C-7 shows the Wind River recommended pull-up / pull-down resistor values 
for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-7 MIPS Broadcom 10-Pin EJTAG Terminations 


Signal Name Description 

TCK 1K pull-up resistor 
TMS 1K pull-up resistor 
TDI 1K pull-up resistor 
TRST 1K pull-down resistor 


C.2.5 MIPS NEC 26-Pin EJTAG Connector 
NEC processors come with a 14- to 26-pin adapter that allows users to connect to 
their target. The NEC 26 pin connector is as follows: 
* 26 (2x13) pins in a plastic shroud 
«1.27 mm between centers of adjacent posts 
* 10mm high 
A sample connector is KEL part number 8811-026-170S. 
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The pinout for the NEC 26 pin connector is shown inFigure C-9. 


Figure C-9 MIPS NEC 26-Pin EJTAG Connector Pinout 


TRCCLK Al B1 GND 
TRCDATAO A2 B2 GND 
TRCDATA1 A3 B3 GND 
TRCDATA2 A4 B4 GND 
TRCDATA3 A5 BS GND 

TRCEND A6 B6 GND 

JTDURMODE# A7 B7 GND 
JTCK A8& B&8 GND 
JTMS AQ B9 GND 
JTDO Ai0 B10 GND 
JTRST# A111 Bi1 N/C 
BRKGIO# A1i2 Bi2 NIC 
NIC A13 B13 (JTMS + 4.7K ohms) 


EJTAG Terminations 


Table C-8 shows the Wind River recommended pull-up / pull-down resistor values 
that must be placed on the target. Signals not shown should not have pull-ups or 
pull-downs. 


Table C-8 MIPS NEC 26-Pin EJTGAG Terminations 


Signal Name Description 

TRCCLK 33 ohm series resistor 
TRCDATAO 33 ohm series resistor 
TRCDATA1 33 ohm series resistor 
TRCDATA2 33 ohm series resistor 
TRCDATA3 33 ohm series resistor 
TRCEND 33 ohm series resistor 
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Table C-8 MIPS NEC 26-Pin EJTGAG Terminations 


Signal Name Description 

JTDI 1K pull-up resistor 
JTCK 1K pull-up resistor 
JTMS 1K pull-up resistor 
JTDO 33 ohm series resistor 
BRKGIO 1K pull-up resistor 


C.2.6 MIPS Toshiba 40-Pin EJTAG Connector 


Toshiba processors come with a 14- to 40-pin adapter that allows users to connect 
to their target. 


The pinout for the Toshiba 40 pin connector is shown in Figure C-10. 
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Figure C-10 MIPS Toshiba 40-Pin Connector Pinout 
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TRESET 1 


TDI/DINT 3 


TDOS 


TS 7 


TCKY 


VCC 11 


RESET 13 


PCSTO 15 


PCST1 17 


PCST2 19 


PCSTS3 21 


PCST4 23 


DCLK 25 


PCST5 27 


PCST6 29 


PCST? 31 


PCST6 33 


TPC1 35 


TPC2 37 


TPC3 39 


2 GND 


4 GND 


6 GND 


8 GND 


10 GND 


12 GND 


14 GND 


16 GND 


18 GND 


20 GND 


22 GND 
24 GND 


26 GND 


28 GND 


30 GND 


32 GND 


34 GND 


36 GND 


38 GND 


40 GND 
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EJTAG Terminations 


Table C-9 shows the Wind River recommended pull-up / pull-down resistor values 
for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-9 MIPS Toshiba 40-Pin EJTAG Terminations 


Signal Name Description 

TRESET 10K pull-up resistor 
TDI/DINT 10K pull-up resistor 
TDO 33 ohm series resistor 
TMS 10K pull-up resistor 
RESET 10K pull-up resistor 
PCSTO 33 ohm series resistor 
PCST1 33 ohm series resistor 
PCST2 33 ohm series resistor 
PCST3 33 ohm series resistor 
PCST4 33 ohm series resistor 
DCLK 33 ohm series resistor 
PCST5 33 ohm series resistor 
PCST6 33 ohm series resistor 
PCST7 33 ohm series resistor 
PCST8 33 ohm series resistor 
TPC1 33 ohm series resistor 
TPC2 33 ohm series resistor 
TPC3 33 ohm series resistor 
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C.3 BDM Pin Terminations 


C.3.1 PowerPC 5xx/8xx 10-pin BDM Connector 


Figure C-11 


Table C-10 


The connector type on your board should be as follows: 

* 10 (2 by 5) 0.025" square posts 

» 0.10" between centers of adjacent posts 

» 0.23" height of each post 

A sample connector is Samtec part number TSW-105-07-S-D. 


Figure C-11 shows the pinouts for this connector. 


10-pin BDM Connector Pinouts 


IPBO/IWYPOVFLSO 1 2 /SRESET 
GND 3 4 C6éCKICK 
SND 5 6 IP_B1/IMMWPI/VFLS1 
‘HRESET 7 8 CSDIDI 
3.3¥ 9 10 DSDQIDS 


The following table contains the Wind River-recommended pull-up/ pull-down 
resistor values that must be placed on the target. Signals not shown should not 
have pull-ups or pull-downs. 


PowerPC 5xx/8xx BDM Terminations 


Signal Name Description 
DSCK/TCK External 10K pull-down 
DSDI External 10K pull-down 
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NOTE: These are the termination values for the Wind River reference design. It is 


C Pin Terminations 
C.3 BDM Pin Terminations 


important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are working with. 


C.3.2 Freescale ColdFire 26-Pin BDM Connector 


The signal pin-out of the ColdFire BDM connector varies by ColdFire processor 
type. This section describes the signal pin-outs for each of the four standard 26 pin 


ColdFire BDM connectors based on the ColdFire processor type. 


Table C-11 breaks down the connector options by processor type. 


Table C-11_ ColdFire Connector Options By Processor Type 


Processor 


Connector Option 


MCF5206E 


MC£5274L, 


MCF5485 


MCF5275, 


MCF5202, MCF5204, MCF5206, 


MCF5249, MCF5249L, MCF 5250, 
MCE 5251, MCF5272, MCF5307, 
MCF5307A, MCF5307B 


MCF5211, MCF5212, MCF5213, 
MCF5214, MCF5216, MCF5232, 
MCF5233, MCF5234, MCF5235, 
MCF5270, MCF5271, MCF5274, 


MCF5275L, 


MCF5280, MCF5281, MCF5282 


MCF5407, MCF5470, MCF5471, 
MCF5472, MCF5473, MCF5474, 
MCF5475, MCF5480, MCF5481, 
MCF5482, MCF5483, MCF5484, 


Option One: ColdFire 26-pin BDM Connector 


Option Two: ColdFire 26-pin BDM Connector 


Option Three: ColdFire 26-pin BDM Connector 


Option Four: ColdFire 26-pin BDM Connector 


ColdFire 26-Pin BDM Connector, Option One 


= 26 (2 by 13) 0.025" square posts 


» 0.10" between centers of adjacent posts 


*» _Asample connector is Samtec part number TSW-113-07-S-D 
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The pin-outs for the 2 by 13, 0.10" on center ColdFire BDM target connector are as 


follows: 


26-Pin BDM Connector: Option One 


RESERVED 1 BKPT 
GND 3 DSCLK 
GND 65 RESERVED 
RESET 7 DS! 
vcc_CPU 9 10 DSO 
GND 11 12 PST3 
PST2 13 14 PST1 
PSTO 15 16 DDATA3 
DDATA2 17 18 DDATA1 
DDATAO 19 20 GND 
RESERVED 21 22 RESERVED 
GND 23 24 CLK_CPU 
vcc_CPU 25 26 TEA 


ColdFire 26-Pin BDM Connector, Option Two 


"26 (2 by 13) 0.025" square posts 
« 0.10" between centers of adjacent posts 
» _Asample connector is Samtec part number TSW-113-07-S-D 


The pin-outs for the 2 by 13, 0.10" on center ColdFire BDM target connector are as 
follows: 
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Figure C-13 26-Pin BDM Connector: Option Two 
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RESERVED BKPT 
GND DSCLK 
GND RESERVED 
RSTI DSI 
vcc_CPU DSO 
GND 11 12 PST3 
PST2 13 14 PST1 
PSTO 15 16 DDATA3 
DDATA2 17 18 DDATA1 
DDATAO 19 20 GND 
RESERVED 21 22 RESERVED 
GND 23 24 PSTCLK 
vcc_CPU 25 26 «TA 


ColdFire 26-Pin BDM Connector, Option Three 


"26 (2 by 13) 0.025" square posts 
» 0.10" between centers of adjacent posts 
» _Asample connector is Samtec part number TSW-113-07-S-D 


The pin-outs for the 2 by 13, 0.10" on center ColdFire BDM target connector are as 
follows: 
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Figure C-14 26-Pin BDM Connector: Option Three 


RESERVED 1 2  BKPT 
GND 3 4 DSCLK 
GND 5 6 RESERVED 
RESET 7? 8 DSI 
VCC_CPU) 9 10 DSO 
GND 11 12 PST3 
PST2 13 14 +PST1 
PSTO = 615 16 DDATA3 
DDATA2 17 18 DDATA1 
DDATAO§ 19 20 GND 
RESERVED 21 22, RESERVED 
GND 23 24 CLKOUT 
VCC_CPU 25 26 TA 


ColdFire 26-Pin BDM Connector, Option Four 


"26 (2 by 13) 0.025" square posts 
» 0.10" between centers of adjacent posts 
» _Asample connector is Samtec part number TSW-113-07-S-D 


The pin-outs for the 2 by 13, 0.10" on center ColdFire BDM target connector are as 
follows: 
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Figure C-15 26-Pin BDM Connector: Option Four 


RESERVED 1 2  BKPT 
GND 3 4 DSCLK 
GND 5 6 RESERVED 
RSTl 7 8 DSI 
vcc_CPU 9 10 DSO 
GND 11 12 PSTDDATA7 
PSTDDATA6 13 14 PSTDDATAS 
PSTDDATA4 15 16 PSTDDATA3 
PSTDDATA2 17 18 PSTDDATA1 
PSTDDATAO 19 20 GND 
RESERVED 21 22 RESERVED 
GND 23 24 PSTCLK 
vcc_CPU 25 26 «TA 


C.4 Mictor Pin Terminations 


The AMCC 40x and 44x processors use a 38-pin Mictor connector when connection 
to the Wind River Trace. The Mictor connector can also be used for run control. 


The recommended manufacturer’s part number for this 38-pin Mictor connector is 
part number AMP 2-767004-2. 


C.4.1 AMCC 40x 38-pin Mictor Connector Pin-out 


This connector’s pin-out information for the AMCC 40x processor is shown in 
Figure C-16. 
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AMCC 40x 38-pin Mictor Connector 


NIC 1 
N/C 3 
N/C 6 
HALT 7 
N/C 9 
TDO 11 
MIC 13 
TCK 15 
TMS 17 
TDI 19 
TRST 21 
HRESET 23 
NC 25 
N/C 27 
NAC 29 
NAC 31 
NMAC 33 
N/C 35 
N#C 35 


This connector’s pin-out information for the AMCC 40x processor is shown in 


Figure C-17. 
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GND 39 
GND 40 
GND 41 
GND 42 


2N/C 
4 Nic 

6 TRCCLK 
BN/C 
1ON/C6 
12 VREF 
14.N/C 
16N/C 
18 N/C 
20 NIC 
22 NIC 
247510 
26 7520 
26 TSIE 
30 TS2E 
32 TS3 
34 754 
36 TS5 
36 TS6 


C.4.2 AMCC 44x 38-pin Mictor Connector Pin-out 


Figure C-17  AMCC 44x 38-pin Mictor Connector 


NC 
NC 
NC 
HALT 
NC 
TDO 
NC 
TCK 
TMS 
TDI 
TRST 
NC 
BSO 
BS1 
BS2 
ESO 
ES1 
ES2 
ES3 


ON aw = 


11 
13 
15 
17 
19 
21 
23 
25 
at 
29 
31 
33 
35 
37 


GNDS 
<-— ond 


— 6ND 
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NC 
NC 
TRCCLK 
NC 
NC 
VREF 
NC 
NC 
NC 
NC 
NC 
ES4 
TSO 
TS1 
TS2 
TS3 
TS4 
TS5 
TS6 
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No terminations are required for any of the trace signal pins. For JTAG 
terminations, see C.1.1 16-Pin JTAG Connector, p.119. 
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